diff --git a/accessible/src/base/nsAccessibilityService.cpp b/accessible/src/base/nsAccessibilityService.cpp
index 38125ff5e08e..006bb72df03c 100644
--- a/accessible/src/base/nsAccessibilityService.cpp
+++ b/accessible/src/base/nsAccessibilityService.cpp
@@ -92,8 +92,8 @@ MustBeAccessible(nsIContent* aContent, DocAccessible* aDocument)
   if (aContent->GetPrimaryFrame()->IsFocusable())
     return true;
 
-  PRUint32 attrCount = aContent->GetAttrCount();
-  for (PRUint32 attrIdx = 0; attrIdx < attrCount; attrIdx++) {
+  uint32_t attrCount = aContent->GetAttrCount();
+  for (uint32_t attrIdx = 0; attrIdx < attrCount; attrIdx++) {
     const nsAttrName* attr = aContent->GetAttrNameAt(attrIdx);
     if (attr->NamespaceEquals(kNameSpaceID_None)) {
       nsIAtom* attrAtom = attr->Atom();
diff --git a/b2g/app/b2g.js b/b2g/app/b2g.js
index 336012e5e8d2..91a084740fa3 100644
--- a/b2g/app/b2g.js
+++ b/b2g/app/b2g.js
@@ -328,9 +328,6 @@ pref("urlclassifier.alternate_error_page", "blocked");
 // The number of random entries to send with a gethash request.
 pref("urlclassifier.gethashnoise", 4);
 
-// Randomize all UrlClassifier data with a per-client key.
-pref("urlclassifier.randomizeclient", false);
-
 // The list of tables that use the gethash request to confirm partial results.
 pref("urlclassifier.gethashtables", "goog-phish-shavar,goog-malware-shavar");
 
diff --git a/b2g/chrome/content/shell.js b/b2g/chrome/content/shell.js
index f77e649d59d5..7125e78a5f65 100644
--- a/b2g/chrome/content/shell.js
+++ b/b2g/chrome/content/shell.js
@@ -974,15 +974,6 @@ window.addEventListener('ContentStart', function update_onContentStart() {
 }, "audio-channel-changed", false);
 })();
 
-(function audioChannelChangedTracker() {
-  Services.obs.addObserver(function(aSubject, aTopic, aData) {
-    shell.sendChromeEvent({
-      type: 'audio-channel-changed',
-      channel: aData
-    });
-}, "audio-channel-changed", false);
-})();
-
 (function recordingStatusTracker() {
   let gRecordingActiveCount = 0;
 
diff --git a/b2g/components/ActivitiesGlue.js b/b2g/components/ActivitiesGlue.js
index c6854572afc3..221aecb71436 100644
--- a/b2g/components/ActivitiesGlue.js
+++ b/b2g/components/ActivitiesGlue.js
@@ -24,7 +24,7 @@ ActivitiesDialog.prototype = {
 
     let choices = [];
     activity.list.forEach(function(item) {
-      choices.push({ title: item.title, icon: item.icon });
+      choices.push({ manifest: item.manifest, icon: item.icon });
     });
 
 
diff --git a/b2g/components/ContentPermissionPrompt.js b/b2g/components/ContentPermissionPrompt.js
index fb67bc778e59..036e7b23a739 100644
--- a/b2g/components/ContentPermissionPrompt.js
+++ b/b2g/components/ContentPermissionPrompt.js
@@ -18,7 +18,7 @@ const Cr = Components.results;
 const Cu = Components.utils;
 const Cc = Components.classes;
 
-const PROMPT_FOR_UNKNOWN = ['geolocation'];
+const PROMPT_FOR_UNKNOWN = ['geolocation', 'desktop-notification'];
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
@@ -88,12 +88,32 @@ ContentPermissionPrompt.prototype = {
     return false;
   },
 
-  _id: 0,
   prompt: function(request) {
     // returns true if the request was handled
     if (this.handleExistingPermission(request))
        return;
 
+    // If the request was initiated from a hidden iframe
+    // we don't forward it to content and cancel it right away
+    let frame = request.element;
+
+    if (!frame) {
+      this.delegatePrompt(request);
+    }
+
+    var self = this;
+    frame.wrappedJSObject.getVisible().onsuccess = function gv_success(evt) {
+      if (!evt.target.result) {
+        request.cancel();
+        return;
+      }
+
+      self.delegatePrompt(request);
+    };
+  },
+
+  _id: 0,
+  delegatePrompt: function(request) {
     let browser = Services.wm.getMostRecentWindow("navigator:browser");
     let content = browser.getContentWindow();
     if (!content)
diff --git a/b2g/components/UpdatePrompt.js b/b2g/components/UpdatePrompt.js
index 4118a9721e55..f62d5893d4f1 100644
--- a/b2g/components/UpdatePrompt.js
+++ b/b2g/components/UpdatePrompt.js
@@ -460,11 +460,20 @@ UpdatePrompt.prototype = {
 
   // nsIRequestObserver
 
+  _startedSent: false,
+
   onStartRequest: function UP_onStartRequest(aRequest, aContext) {
-    this.sendChromeEvent("update-downloading");
+    // Wait until onProgress to send the update-download-started event, in case
+    // this request turns out to fail for some reason
+    this._startedSent = false;
   },
 
   onStopRequest: function UP_onStopRequest(aRequest, aContext, aStatusCode) {
+    let paused = !Components.isSuccessCode(aStatusCode);
+    this.sendChromeEvent("update-download-stopped", {
+        paused: paused
+    });
+
     Services.aus.removeDownloadListener(this);
   },
 
@@ -472,7 +481,14 @@ UpdatePrompt.prototype = {
 
   onProgress: function UP_onProgress(aRequest, aContext, aProgress,
                                      aProgressMax) {
-    this.sendChromeEvent("update-progress", {
+    if (!this._startedSent) {
+      this.sendChromeEvent("update-download-started", {
+        total: aProgressMax
+      });
+      this._startedSent = true;
+    }
+
+    this.sendChromeEvent("update-download-progress", {
       progress: aProgress,
       total: aProgressMax
     });
diff --git a/b2g/components/YoutubeProtocolHandler.js b/b2g/components/YoutubeProtocolHandler.js
index 189a6d9889f7..d9e1498c27b1 100644
--- a/b2g/components/YoutubeProtocolHandler.js
+++ b/b2g/components/YoutubeProtocolHandler.js
@@ -31,155 +31,27 @@ YoutubeProtocolHandler.prototype = {
 
   // Sample URL:
   // vnd.youtube:iNuKL2Gy_QM?vndapp=youtube_mobile&vndclient=mv-google&vndel=watch&vnddnc=1
+  // Note that there is no hostname, so we use URLTYPE_NO_AUTHORITY
   newURI: function yt_phNewURI(aSpec, aOriginCharset, aBaseURI) {
     let uri = Cc["@mozilla.org/network/standard-url;1"]
               .createInstance(Ci.nsIStandardURL);
-    let id = aSpec.substring(this.scheme.length + 1);
-    id = id.substring(0, id.indexOf('?'));
-    uri.init(Ci.nsIStandardURL.URLTYPE_STANDARD, -1, this.scheme + "://dummy_host/" + id, aOriginCharset,
-             aBaseURI);
+    uri.init(Ci.nsIStandardURL.URLTYPE_NO_AUTHORITY, this.defaultPort,
+             aSpec, aOriginCharset, aBaseURI);
     return uri.QueryInterface(Ci.nsIURI);
   },
 
   newChannel: function yt_phNewChannel(aURI) {
-    // Get a list of streams for this video id.
-    let infoURI = "http://www.youtube.com/get_video_info?&video_id=" +
-                  aURI.path.substring(1);
-
-    let xhr = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"]
-                .createInstance(Ci.nsIXMLHttpRequest);
-    xhr.open("GET", infoURI, true);
-    xhr.addEventListener("load", function() {
-      try {
-        let info = parseYoutubeVideoInfo(xhr.responseText);
-        cpmm.sendAsyncMessage("content-handler", info);
-      }
-      catch(e) {
-        // If parseYoutubeVideoInfo() can't find a video URL, it
-        // throws an Error. We report the error message here and do
-        // nothing. This shouldn't happen often. But if it does, the user
-        // will find that clicking on a video doesn't do anything.
-        log(e.message);
-      }
+    /*
+     * This isn't a real protocol handler. Instead of creating a channel
+     * we just send a message and throw an exception. This 'content-handler'
+     * message is handled in b2g/chrome/content/shell.js where it starts
+     * an activity request that will open the Video app. The video app
+     * includes code to handle this fake 'video/youtube' mime type
+     */
+    cpmm.sendAsyncMessage("content-handler", {
+      type: 'video/youtube', // A fake MIME type for the activity handler
+      url: aURI.spec         // The path component of this URL is the video id
     });
-    xhr.send(null);
-
-    function log(msg) {
-      msg = "YoutubeProtocolHandler.js: " + (msg.join ? msg.join(" ") : msg);
-      Cc["@mozilla.org/consoleservice;1"]
-        .getService(Ci.nsIConsoleService)
-        .logStringMessage(msg);
-    }
-
-    // 
-    // Parse the response from a youtube get_video_info query.
-    // 
-    // If youtube's response is a failure, this function returns an object
-    // with status, errorcode, type and reason properties. Otherwise, it returns
-    // an object with status, url, and type properties, and optional
-    // title, poster, and duration properties.
-    // 
-    function parseYoutubeVideoInfo(response) {
-      // Splits parameters in a query string.
-      function extractParameters(q) {
-        let params = q.split("&");
-        let result = {};
-        for(let i = 0, n = params.length; i < n; i++) {
-          let param = params[i];
-          let pos = param.indexOf('=');
-          if (pos === -1) 
-            continue;
-          let name = param.substring(0, pos);
-          let value = param.substring(pos+1);
-          result[name] = decodeURIComponent(value);
-        }
-        return result;
-      }
-
-      let params = extractParameters(response);
-      
-      // If the request failed, return an object with an error code
-      // and an error message
-      if (params.status === 'fail') {
-        // 
-        // Hopefully this error message will be properly localized.
-        // Do we need to add any parameters to the XMLHttpRequest to 
-        // specify the language we want?
-        // 
-        // Note that we include fake type and url properties in the returned
-        // object. This is because we still need to trigger the video app's
-        // view activity handler to display the error message from youtube,
-        // and those parameters are required.
-        //
-        return {
-          status: params.status,
-          errorcode: params.errorcode,
-          reason:  (params.reason || '').replace(/\+/g, ' '),
-          type: 'video/3gpp',
-          url: 'https://m.youtube.com'
-        }
-      }
-
-      // Otherwise, the query was successful
-      let result = {
-        status: params.status,
-      };
-
-      // Now parse the available streams
-      let streamsText = params.url_encoded_fmt_stream_map;
-      if (!streamsText)
-        throw Error("No url_encoded_fmt_stream_map parameter");
-      let streams = streamsText.split(',');
-      for(let i = 0, n = streams.length; i < n; i++) {
-        streams[i] = extractParameters(streams[i]);
-      }
-
-      // This is the list of youtube video formats, ordered from worst
-      // (but playable) to best.  These numbers are values used as the
-      // itag parameter of each stream description. See
-      // https://en.wikipedia.org/wiki/YouTube#Quality_and_codecs
-      let formats = [
-        "17", // 144p 3GP
-        "36", // 240p 3GP
-        "43", // 360p WebM
-#ifdef MOZ_WIDGET_GONK
-        "18", // 360p H.264
-#endif
-      ];
-
-      // Sort the array of stream descriptions in order of format
-      // preference, so that the first item is the most preferred one
-      streams.sort(function(a, b) {
-        let x = a.itag ? formats.indexOf(a.itag) : -1;
-        let y = b.itag ? formats.indexOf(b.itag) : -1;
-        return y - x;
-      });
-
-      let bestStream = streams[0];
-
-      // If the best stream is a format we don't support just return
-      if (formats.indexOf(bestStream.itag) === -1) 
-        throw Error("No supported video formats");
-
-      result.url = bestStream.url + '&signature=' + (bestStream.sig || '');
-      result.type = bestStream.type;
-      // Strip codec information off of the mime type
-      if (result.type && result.type.indexOf(';') !== -1) {
-        result.type = result.type.split(';',1)[0];
-      }
-
-      if (params.title) {
-        result.title = params.title.replace(/\+/g, ' ');
-      }
-      if (params.length_seconds) {
-        result.duration = params.length_seconds;
-      }
-      if (params.thumbnail_url) {
-        result.poster = params.thumbnail_url;
-      }
-
-      return result;
-    }
 
     throw Components.results.NS_ERROR_ILLEGAL_VALUE;
   },
diff --git a/browser/app/profile/extensions/Makefile.in b/browser/app/profile/extensions/Makefile.in
index fff217f4abee..9e96bbd395da 100644
--- a/browser/app/profile/extensions/Makefile.in
+++ b/browser/app/profile/extensions/Makefile.in
@@ -27,14 +27,6 @@ all_xpis = $(foreach dir,$(EXTENSIONS),$(DISTROEXT)/$(dir).xpi)
 libs:: $(all_xpis)
 GARBAGE += $(all_xpis)
 
-$(all_xpis): $(DISTROEXT)/%.xpi: $(call mkdir_deps,$(DISTROEXT)) libs-%
-	cd $* && \
-	$(ZIP) -r9XD $@ * -x \*.in -x \*.mkdir.done
-	cd $(call core_abspath,$(srcdir)/$*) && \
-	$(ZIP) -r9XD $@ * -x \*.in -x \*.mkdir.done
-
-.PHONY: $(all_xpis:.xpi=)
-
 define pp_one
 $(2) := $(2)
 $(2)_PATH := $(dir $(2))
@@ -50,3 +42,11 @@ $(foreach d,$(EXTENSIONS), \
 endif
 
 include $(topsrcdir)/config/rules.mk
+
+$(all_xpis): $(DISTROEXT)/%.xpi: $(call mkdir_deps,$(DISTROEXT)) libs-%
+	cd $* && \
+	$(ZIP) -r9XD $@ * -x \*.in -x \*.mkdir.done
+	cd $(call core_abspath,$(srcdir)/$*) && \
+	$(ZIP) -r9XD $@ * -x \*.in -x \*.mkdir.done
+
+.PHONY: $(all_xpis:.xpi=)
diff --git a/browser/app/profile/firefox.js b/browser/app/profile/firefox.js
index 2606af4a99f6..04e711f52a0a 100644
--- a/browser/app/profile/firefox.js
+++ b/browser/app/profile/firefox.js
@@ -736,9 +736,6 @@ pref("urlclassifier.alternate_error_page", "blocked");
 // The number of random entries to send with a gethash request.
 pref("urlclassifier.gethashnoise", 4);
 
-// Randomize all UrlClassifier data with a per-client key.
-pref("urlclassifier.randomizeclient", false);
-
 // The list of tables that use the gethash request to confirm partial results.
 pref("urlclassifier.gethashtables", "goog-phish-shavar,goog-malware-shavar");
 
diff --git a/browser/base/content/browser-plugins.js b/browser/base/content/browser-plugins.js
index ad8be8ad39e0..80e0df19e4b8 100644
--- a/browser/base/content/browser-plugins.js
+++ b/browser/base/content/browser-plugins.js
@@ -280,8 +280,7 @@ var gPluginHandler = {
 
     let notification = PopupNotifications.getNotification("click-to-play-plugins", aBrowser);
     if (notification && plugins.length > 0 && !haveVisibleCTPPlugin && !this._notificationDisplayedOnce) {
-      notification.dismissed = false;
-      PopupNotifications._update(notification.anchorElement);
+      notification.reshow();
       this._notificationDisplayedOnce = true;
     }
 
diff --git a/browser/base/content/browser-social.js b/browser/base/content/browser-social.js
index fba887531322..1b2561acf46b 100644
--- a/browser/base/content/browser-social.js
+++ b/browser/base/content/browser-social.js
@@ -132,7 +132,7 @@ let SocialUI = {
           break;
       }
     } catch (e) {
-      Components.utils.reportError(e + e.stack);
+      Components.utils.reportError(e + "\n" + e.stack);
       throw e;
     }
   },
@@ -719,6 +719,8 @@ var SocialToolbar = {
     if (!Social.provider)
       return;
     this.button.style.listStyleImage = "url(" + Social.provider.iconURL + ")";
+    this.button.setAttribute("label", Social.provider.name);
+    this.button.setAttribute("tooltiptext", Social.provider.name);
     this.updateButton();
     this.updateProfile();
     this.populateProviderMenus();
@@ -779,7 +781,6 @@ var SocialToolbar = {
     let provider = Social.provider;
     let icons = provider.ambientNotificationIcons;
     let iconNames = Object.keys(icons);
-    let iconBox = document.getElementById("social-toolbar-item");
     let panel = document.getElementById("social-notification-panel");
     panel.hidden = false;
 
@@ -824,7 +825,7 @@ var SocialToolbar = {
                                      str);
     }
 
-    let iconContainers = document.createDocumentFragment();
+    let toolbarButtons = document.createDocumentFragment();
 
     let createdFrames = [];
 
@@ -835,7 +836,6 @@ var SocialToolbar = {
       let notificationFrame = document.getElementById(notificationFrameId);
 
       if (!notificationFrame) {
-
         notificationFrame = SharedFrame.createFrame(
           notificationFrameId, /* frame name */
           panel, /* parent */
@@ -860,56 +860,41 @@ var SocialToolbar = {
         SharedFrame.updateURL(notificationFrameId, icon.contentPanel);
       }
 
-      let iconId = "social-notification-icon-" + icon.name;
-      let imageId = iconId + "-image";
-      let labelId = iconId + "-label";
-      let stackId = iconId + "-stack";
-      let stack = document.getElementById(stackId);
-      let image, label;
-      if (stack) {
-        image = document.getElementById(imageId);
-        label = document.getElementById(labelId);
-      } else {
-        let box = document.createElement("box");
-        box.classList.add("toolbarbutton-1");
-        box.setAttribute("id", iconId);
-        // Use the accessibility menuitem label as tooltiptext.
-        if (icon.label)
-          box.setAttribute("tooltiptext", icon.label);
-        box.addEventListener("mousedown", function (e) {
-          if (e.button == 0)
-            SocialToolbar.showAmbientPopup(box);
-        }, false);
-        box.setAttribute("notificationFrameId", notificationFrameId);
-        stack = document.createElement("stack");
-        stack.setAttribute("id", stackId);
-        stack.classList.add("social-notification-icon-stack");
-        stack.classList.add("toolbarbutton-icon");
-        image = document.createElement("image");
-        image.setAttribute("id", imageId);
-        image.classList.add("social-notification-icon-image");
-        image = stack.appendChild(image);
-        label = document.createElement("label");
-        label.setAttribute("id", labelId);
-        label.classList.add("social-notification-icon-label");
-        let hbox = document.createElement("hbox");
-        hbox.classList.add("social-notification-icon-hbox");
-        hbox.setAttribute("align", "start");
-        hbox.setAttribute("pack", "end");
-        label = hbox.appendChild(label);
-        stack.appendChild(hbox);
-        box.appendChild(stack);
-        iconContainers.appendChild(box);
+      let toolbarButtonContainerId = "social-notification-container-" + icon.name;
+      let toolbarButtonId = "social-notification-icon-" + icon.name;
+      let toolbarButtonContainer = document.getElementById(toolbarButtonContainerId);
+      let toolbarButton = document.getElementById(toolbarButtonId);
+      if (!toolbarButtonContainer) {
+        // The container is used to fix an issue with position:absolute on
+        // generated content not being constrained to the bounding box of a
+        // parent toolbarbutton that has position:relative.
+        toolbarButtonContainer = document.createElement("toolbaritem");
+        toolbarButtonContainer.classList.add("social-notification-container");
+        toolbarButtonContainer.setAttribute("id", toolbarButtonContainerId);
+
+        toolbarButton = document.createElement("toolbarbutton");
+        toolbarButton.classList.add("toolbarbutton-1");
+        toolbarButton.setAttribute("id", toolbarButtonId);
+        toolbarButton.setAttribute("notificationFrameId", notificationFrameId);
+        toolbarButton.addEventListener("mousedown", function (event) {
+          if (event.button == 0)
+            SocialToolbar.showAmbientPopup(toolbarButton);
+        });
+
+        toolbarButtonContainer.appendChild(toolbarButton);
+        toolbarButtons.appendChild(toolbarButtonContainer);
       }
 
-      let labelValue = icon.counter || "";
-      // Only update the value attribute if it has changed to reduce layout changes.
-      if (!label.hasAttribute("value") || label.getAttribute("value") != labelValue)
-        label.setAttribute("value", labelValue);
+      toolbarButton.style.listStyleImage = "url(" + icon.iconURL + ")";
+      toolbarButton.setAttribute("label", icon.label);
+      toolbarButton.setAttribute("tooltiptext", icon.label);
 
-      image.style.listStyleImage = "url(" + icon.iconURL + ")";
+      let badge = icon.counter || "";
+      if (toolbarButton.getAttribute("badge") != badge)
+        toolbarButton.setAttribute("badge", badge);
     }
-    iconBox.appendChild(iconContainers);
+    let socialToolbarItem = document.getElementById("social-toolbar-item");
+    socialToolbarItem.appendChild(toolbarButtons);
 
     for (let frame of createdFrames) {
       if (frame.docShell) {
@@ -923,12 +908,12 @@ var SocialToolbar = {
     }
   },
 
-  showAmbientPopup: function SocialToolbar_showAmbientPopup(aToolbarButtonBox) {
+  showAmbientPopup: function SocialToolbar_showAmbientPopup(aToolbarButton) {
     // Hide any other social panels that may be open.
     SocialFlyout.panel.hidePopup();
 
     let panel = document.getElementById("social-notification-panel");
-    let notificationFrameId = aToolbarButtonBox.getAttribute("notificationFrameId");
+    let notificationFrameId = aToolbarButton.getAttribute("notificationFrameId");
     let notificationFrame = document.getElementById(notificationFrameId);
 
     let wasAlive = SharedFrame.isGroupAlive(notificationFrameId);
@@ -951,7 +936,8 @@ var SocialToolbar = {
     let dynamicResizer = this._dynamicResizer;
     panel.addEventListener("popuphidden", function onpopuphiding() {
       panel.removeEventListener("popuphidden", onpopuphiding);
-      aToolbarButtonBox.removeAttribute("open");
+      aToolbarButton.removeAttribute("open");
+      aToolbarButton.parentNode.removeAttribute("open");
       dynamicResizer.stop();
       notificationFrame.docShell.isActive = false;
       dispatchPanelEvent("socialFrameHide");
@@ -959,7 +945,13 @@ var SocialToolbar = {
 
     panel.addEventListener("popupshown", function onpopupshown() {
       panel.removeEventListener("popupshown", onpopupshown);
-      aToolbarButtonBox.setAttribute("open", "true");
+      // This attribute is needed on both the button and the
+      // containing toolbaritem since the buttons on OS X have
+      // moz-appearance:none, while their container gets
+      // moz-appearance:toolbarbutton due to the way that toolbar buttons
+      // get combined on OS X.
+      aToolbarButton.setAttribute("open", "true");
+      aToolbarButton.parentNode.setAttribute("open", "true");
       notificationFrame.docShell.isActive = true;
       notificationFrame.docShell.isAppTab = true;
       if (notificationFrame.contentDocument.readyState == "complete" && wasAlive) {
@@ -977,9 +969,8 @@ var SocialToolbar = {
       }
     });
 
-    let imageId = aToolbarButtonBox.getAttribute("id") + "-image";
-    let toolbarButtonImage = document.getElementById(imageId);
-    panel.openPopup(toolbarButtonImage, "bottomcenter topright", 0, 0, false, false);
+    let toolbarButtonIcon = document.getAnonymousElementByAttribute(aToolbarButton, "class", "toolbarbutton-icon");
+    panel.openPopup(toolbarButtonIcon, "bottomcenter topright", 0, 0, false, false);
   },
 
   setPanelErrorMessage: function SocialToolbar_setPanelErrorMessage(aNotificationFrame) {
diff --git a/browser/base/content/browser.css b/browser/base/content/browser.css
index 404b6273eec2..4f2f1d2744ee 100644
--- a/browser/base/content/browser.css
+++ b/browser/base/content/browser.css
@@ -618,6 +618,10 @@ html|*#gcli-output-frame,
   transition: none;
 }
 
+.social-notification-container > .toolbarbutton-1[badge]:not([badge=""])::after {
+  content: attr(badge);
+}
+
 chatbox {
   -moz-binding: url("chrome://browser/content/socialchat.xml#chatbox");
 }
diff --git a/browser/base/content/browser.js b/browser/base/content/browser.js
index 646a1e703f37..67abe5c76a51 100644
--- a/browser/base/content/browser.js
+++ b/browser/base/content/browser.js
@@ -6925,6 +6925,12 @@ let gPrivateBrowsingUI = {
       return;
     }
 
+#ifdef XP_MACOSX
+    if (!PrivateBrowsingUtils.permanentPrivateBrowsing) {
+      document.documentElement.setAttribute("drawintitlebar", true);
+    }
+#endif
+
     // Disable the Clear Recent History... menu item when in PB mode
     // temporary fix until bug 463607 is fixed
     document.getElementById("Tools:Sanitize").setAttribute("disabled", "true");
@@ -6936,7 +6942,8 @@ let gPrivateBrowsingUI = {
         docElement.getAttribute("title_privatebrowsing"));
       docElement.setAttribute("titlemodifier",
         docElement.getAttribute("titlemodifier_privatebrowsing"));
-      docElement.setAttribute("privatebrowsingmode", "temporary");
+      docElement.setAttribute("privatebrowsingmode",
+        PrivateBrowsingUtils.permanentPrivateBrowsing ? "permanent" : "temporary");
       gBrowser.updateTitlebar();
     }
 
diff --git a/browser/base/content/test/browser_pluginnotification.js b/browser/base/content/test/browser_pluginnotification.js
index 54b117d4b9f9..bf9fd5ab606f 100644
--- a/browser/base/content/test/browser_pluginnotification.js
+++ b/browser/base/content/test/browser_pluginnotification.js
@@ -827,9 +827,8 @@ function test21a() {
   }
 
   // we have to actually show the panel to get the bindings to instantiate
-  notification.options.dismissed = false;
   notification.options.eventCallback = test21b;
-  PopupNotifications._showPanel([notification], notification.anchorElement);
+  notification.reshow();
 }
 
 function test21b() {
@@ -887,9 +886,8 @@ function test21c() {
   }
 
   // we have to actually show the panel to get the bindings to instantiate
-  notification.options.dismissed = false;
   notification.options.eventCallback = test21d;
-  PopupNotifications._showPanel([notification], notification.anchorElement);
+  notification.reshow();
 }
 
 function test21d() {
diff --git a/browser/base/content/test/social/browser_social_mozSocial_API.js b/browser/base/content/test/social/browser_social_mozSocial_API.js
index fbe9c7a8211e..215f55a8ae79 100644
--- a/browser/base/content/test/social/browser_social_mozSocial_API.js
+++ b/browser/base/content/test/social/browser_social_mozSocial_API.js
@@ -28,10 +28,10 @@ var tests = {
     }
 
     function triggerIconPanel() {
-      let statusIcon = document.querySelector("#social-toolbar-item > box");
+      let statusIcon = document.querySelector("#social-toolbar-item > .social-notification-container > .toolbarbutton-1");
       info("status icon is " + statusIcon);
       waitForCondition(function() {
-        statusIcon = document.querySelector("#social-toolbar-item > box");
+        statusIcon = document.querySelector("#social-toolbar-item > .social-notification-container > .toolbarbutton-1");
         info("status icon is " + statusIcon);
         return !!statusIcon;
       }, function() {
diff --git a/browser/base/content/test/social/browser_social_toolbar.js b/browser/base/content/test/social/browser_social_toolbar.js
index f28bbc1717a9..b5162f61c948 100644
--- a/browser/base/content/test/social/browser_social_toolbar.js
+++ b/browser/base/content/test/social/browser_social_toolbar.js
@@ -103,17 +103,18 @@ var tests = {
     Social.provider.setAmbientNotification(ambience2);
     Social.provider.setAmbientNotification(ambience3);
 
-    let statusIcon = document.querySelector("#social-toolbar-item > box");
+    let statusIcon = document.querySelector("#social-toolbar-item > .social-notification-container > .toolbarbutton-1");
     waitForCondition(function() {
-      statusIcon = document.querySelector("#social-toolbar-item > box");
+      statusIcon = document.querySelector("#social-toolbar-item > .social-notification-container > .toolbarbutton-1");
       return !!statusIcon;
     }, function () {
-      let statusIconLabel = statusIcon.querySelector("label");
-      is(statusIconLabel.value, "42", "status value is correct");
+      let badge = statusIcon.getAttribute("badge");
+      is(badge, "42", "status value is correct");
 
       ambience.counter = 0;
       Social.provider.setAmbientNotification(ambience);
-      is(statusIconLabel.value, "", "status value is correct");
+      badge = statusIcon.getAttribute("badge");
+      is(badge, "", "status value is correct");
 
       // The menu bar isn't as easy to instrument on Mac.
       if (navigator.platform.contains("Mac"))
diff --git a/browser/components/Makefile.in b/browser/components/Makefile.in
index 07ca3eb9a96a..a9caa5a5f1e2 100644
--- a/browser/components/Makefile.in
+++ b/browser/components/Makefile.in
@@ -17,8 +17,11 @@ XPIDLSRCS = \
   nsIBrowserHandler.idl \
   $(NULL)
 
-EXTRA_PP_COMPONENTS = \
+EXTRA_COMPONENTS = \
   BrowserComponents.manifest \
+  $(NULL)
+
+EXTRA_PP_COMPONENTS = \
   nsBrowserContentHandler.js \
   nsBrowserGlue.js \
   $(NULL)
diff --git a/browser/components/downloads/content/allDownloadsViewOverlay.css b/browser/components/downloads/content/allDownloadsViewOverlay.css
index 45c511881548..71e56b96b9fc 100644
--- a/browser/components/downloads/content/allDownloadsViewOverlay.css
+++ b/browser/components/downloads/content/allDownloadsViewOverlay.css
@@ -1,8 +1,8 @@
 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
- 
-richlistitem.download {
+
+richlistitem.download[active] {
   -moz-binding: url('chrome://browser/content/downloads/download.xml#download-full-ui');
 }
 
@@ -13,12 +13,12 @@ richlistitem.download {
 .download-state:not(:-moz-any([state="2"], /* Failed             */
                               [state="4"]) /* Paused             */)
                                            .downloadCancelMenuItem,
-.download-state:not(:-moz-any([state="1"], /* Finished           */
-                              [state="2"], /* Failed             */
-                              [state="3"], /* Canceled           */
-                              [state="6"], /* Blocked (parental) */
-                              [state="8"], /* Blocked (dirty)    */
-                              [state="9"]) /* Blocked (policy)   */)
+.download-state[state]:not(:-moz-any([state="1"], /* Finished           */
+                                     [state="2"], /* Failed             */
+                                     [state="3"], /* Canceled           */
+                                     [state="6"], /* Blocked (parental) */
+                                     [state="8"], /* Blocked (dirty)    */
+                                     [state="9"]) /* Blocked (policy)   */)
                                            .downloadRemoveFromHistoryMenuItem,
 .download-state:not(:-moz-any([state="-1"],/* Starting (initial) */
                               [state="0"], /* Downloading        */
@@ -26,8 +26,7 @@ richlistitem.download {
                               [state="4"], /* Paused             */
                               [state="5"]) /* Starting (queued)  */)
                                            .downloadShowMenuItem,
-.download-state[state="7"]                 .downloadCommandsSeparator,
-.download-state:not([state])                 .downloadCommandsSeparator
+.download-state[state="7"]                 .downloadCommandsSeparator
 {
   display: none;
 }
diff --git a/browser/components/downloads/content/allDownloadsViewOverlay.js b/browser/components/downloads/content/allDownloadsViewOverlay.js
index 21a54362c9a7..f0e298760c75 100644
--- a/browser/components/downloads/content/allDownloadsViewOverlay.js
+++ b/browser/components/downloads/content/allDownloadsViewOverlay.js
@@ -78,7 +78,7 @@ function DownloadElementShell(aDataItem, aPlacesNode, aAnnotations) {
   this._element.classList.add("download");
   this._element.classList.add("download-state");
 
- if (aAnnotations)
+  if (aAnnotations)
     this._annotations = aAnnotations;
   if (aDataItem)
     this.dataItem = aDataItem;
@@ -90,12 +90,30 @@ DownloadElementShell.prototype = {
   // The richlistitem for the download
   get element() this._element,
 
+  /**
+   * Manages the "active" state of the shell.  By default all the shells
+   * without a dataItem are inactive, thus their UI is not updated.  They must
+   * be activated when entering the visible area.  Session downloads are
+   * always active since they always have a dataItem.
+   */
+  ensureActive: function DES_ensureActive() {
+    if (this._active)
+      return;
+    this._active = true;
+    this._element.setAttribute("active", true);
+    this._updateStatusUI();
+    this._fetchTargetFileInfo();
+  },
+  get active() !!this._active,
+
   // The data item for the download
   _dataItem: null,
   get dataItem() this._dataItem,
 
   set dataItem(aValue) {
-    if ((this._dataItem = aValue)) {
+    this._dataItem = aValue;
+    if (this._dataItem) {
+      this._active = true;
       this._wasDone = this._dataItem.done;
       this._wasInProgress = this._dataItem.inProgress;
       this._targetFileInfoFetched = false;
@@ -105,10 +123,12 @@ DownloadElementShell.prototype = {
       this._wasInProgress = false;
       this._wasDone = this.getDownloadState(true) == nsIDM.DOWNLOAD_FINISHED;
       this._targetFileInfoFetched = false;
-      this._fetchTargetFileInfo();
+      if (this.active)
+        this._fetchTargetFileInfo();
     }
 
-    this._updateStatusUI();
+    it (this.active)
+      this._updateStatusUI();
     return aValue;
   },
 
@@ -129,8 +149,10 @@ DownloadElementShell.prototype = {
         this._wasInProgress = false;
         this._wasDone = this.getDownloadState(true) == nsIDM.DOWNLOAD_FINISHED;
         this._targetFileInfoFetched = false;
-        this._updateStatusUI();
-        this._fetchTargetFileInfo();
+        if (this.active) {
+          this._updateStatusUI();
+          this._fetchTargetFileInfo();
+        }
       }
     }
     return aNode;
@@ -154,8 +176,13 @@ DownloadElementShell.prototype = {
   get _icon() {
     if (this._targetFileURI)
       return "moz-icon://" + this._targetFileURI + "?size=32";
-    if (this._placesNode)
-      return this.placesNode.icon;
+    if (this._placesNode) {
+      // Try to extract an extension from the uri.
+      let ext = this._downloadURIObj.QueryInterface(Ci.nsIURL).fileExtension;
+      if (ext)
+        return "moz-icon://." + ext + "?size=32";
+      return this._placesNode.icon || "moz-icon://.unknown?size=32";
+    }
     if (this._dataItem)
       throw new Error("Session-download items should always have a target file uri");
     throw new Error("Unexpected download element state");
@@ -223,6 +250,8 @@ DownloadElementShell.prototype = {
   _fetchTargetFileInfo: function DES__fetchTargetFileInfo() {
     if (this._targetFileInfoFetched)
       throw new Error("_fetchTargetFileInfo should not be called if the information was already fetched");
+    if (!this.active)
+      throw new Error("Trying to _fetchTargetFileInfo on an inactive download shell");
 
     let path = this._targetFilePath;
 
@@ -406,6 +435,8 @@ DownloadElementShell.prototype = {
   },
 
   _updateStatusUI: function DES__updateStatusUI() {
+    if (!this.active)
+      throw new Error("Trying to _updateStatusUI on an inactive download shell");
     this._element.setAttribute("displayName", this._displayName);
     this._element.setAttribute("image", this._icon);
     this._updateDownloadStatusUI();
@@ -446,7 +477,8 @@ DownloadElementShell.prototype = {
       this._element.setAttribute("image", this._icon + "&state=normal");
 
       this._targetFileInfoFetched = false;
-      this._fetchTargetFileInfo();
+      if (this.active)
+        this._fetchTargetFileInfo();
     }
 
     this._wasDone = this._dataItem.done;
@@ -471,6 +503,9 @@ DownloadElementShell.prototype = {
 
   /* nsIController */
   isCommandEnabled: function DES_isCommandEnabled(aCommand) {
+    // The only valid command for inactive elements is cmd_delete.
+    if (!this.active && aCommand != "cmd_delete")
+      return false;
     switch (aCommand) {
       case "downloadsCmd_open": {
         // We cannot open a session dowload file unless it's done ("openable").
@@ -574,7 +609,8 @@ DownloadElementShell.prototype = {
   // show up in the search results for the given term.  Both the display
   // name for the download and the url are searched.
   matchesSearchTerm: function DES_matchesSearchTerm(aTerm) {
-    // Stub implemention until we figure out something better
+    if (!aTerm)
+      return true;
     aTerm = aTerm.toLowerCase();
     return this._displayName.toLowerCase().indexOf(aTerm) != -1 ||
            this.downloadURI.toLowerCase().indexOf(aTerm) != -1;
@@ -623,7 +659,7 @@ DownloadElementShell.prototype = {
  * as they exist they "collapses" their history "counterpart" (So we don't show two
  * items for every download).
  */
-function DownloadsPlacesView(aRichListBox) {
+function DownloadsPlacesView(aRichListBox, aActive = true) {
   this._richlistbox = aRichListBox;
   this._richlistbox._placesView = this;
   this._richlistbox.controllers.appendController(this);
@@ -640,6 +676,8 @@ function DownloadsPlacesView(aRichListBox) {
 
   this._searchTerm = "";
 
+  this._active = aActive;
+
   // Register as a downloads view. The places data will be initialized by
   // the places setter.
   let downloadsData = DownloadsCommon.getData(window.opener || window);
@@ -651,11 +689,23 @@ function DownloadsPlacesView(aRichListBox) {
     downloadsData.removeView(this);
     this.result = null;
   }.bind(this), true);
+  // Resizing the window may change items visibility.
+  window.addEventListener("resize", function() {
+    this._ensureVisibleElementsAreActive();
+  }.bind(this), true);
 }
 
 DownloadsPlacesView.prototype = {
   get associatedElement() this._richlistbox,
 
+  get active() this._active,
+  set active(val) {
+    this._active = val;
+    if (this._active)
+      this._ensureVisibleElementsAreActive();
+    return this._active;
+  },
+
   _forEachDownloadElementShellForURI:
   function DPV__forEachDownloadElementShellForURI(aURI, aCallback) {
     if (this._downloadElementsShellsForURI.has(aURI)) {
@@ -811,6 +861,11 @@ DownloadsPlacesView.prototype = {
           !newOrUpdatedShell.element._shell.matchesSearchTerm(this.searchTerm);
       }
     }
+
+    // If aDocumentFragment is defined this is a batch change, so it's up to
+    // the caller to append the fragment and activate the visible shells.
+    if (!aDocumentFragment)
+      this._ensureVisibleElementsAreActive();
   },
 
   _removeElement: function DPV__removeElement(aElement) {
@@ -823,6 +878,7 @@ DownloadsPlacesView.prototype = {
       this._richlistbox.selectItem(aElement.nextSibling);
     }
     this._richlistbox.removeChild(aElement);
+    this._ensureVisibleElementsAreActive();
   },
 
   _removeHistoryDownloadFromView:
@@ -879,6 +935,38 @@ DownloadsPlacesView.prototype = {
     }
   },
 
+  _ensureVisibleElementsAreActive:
+  function DPV__ensureVisibleElementsAreActive() {
+    if (!this.active || this._ensureVisibleTimer || !this._richlistbox.firstChild)
+      return;
+
+    this._ensureVisibleTimer = setTimeout(function() {
+      delete this._ensureVisibleTimer;
+
+      let rlRect = this._richlistbox.getBoundingClientRect();
+      let fcRect = this._richlistbox.firstChild.getBoundingClientRect();
+      // For simplicity assume border and padding are the same across all sides.
+      // This works as far as there isn't an horizontal scrollbar since fcRect
+      // is relative to the scrolled area.
+      let offset = fcRect.left - rlRect.left + 1;
+
+      let firstVisible = document.elementFromPoint(fcRect.left, rlRect.top + offset);
+      if (!firstVisible || firstVisible.localName != "richlistitem")
+        throw new Error("_ensureVisibleElementsAreActive invoked on the wrong view");
+
+      let lastVisible = document.elementFromPoint(fcRect.left, rlRect.bottom - offset);
+      // If the last visible child found is not a richlistitem, then there are
+      // less items than the available space, thus just proceed to the last child.
+      if (!lastVisible || lastVisible.localName != "richlistitem")
+        lastVisible = this._richlistbox.lastChild;
+
+      for (let elt = firstVisible; elt != lastVisible.nextSibling; elt = elt.nextSibling) {
+        if (elt._shell)
+          elt._shell.ensureActive();
+      }
+    }.bind(this), 10);
+  },
+
   _place: "",
   get place() this._place,
   set place(val) {
@@ -975,6 +1063,7 @@ DownloadsPlacesView.prototype = {
     }
 
     this._richlistbox.appendChild(elementsToAppendFragment);
+    this._ensureVisibleElementsAreActive();
   },
 
   nodeInserted: function DPV_nodeInserted(aParent, aPlacesNode) {
@@ -1022,6 +1111,7 @@ DownloadsPlacesView.prototype = {
       for (let element of this._richlistbox.childNodes) {
         element.hidden = !element._shell.matchesSearchTerm(aValue);
       }
+      this._ensureVisibleElementsAreActive();
     }
     return this._searchTerm = aValue;
   },
@@ -1198,6 +1288,10 @@ DownloadsPlacesView.prototype = {
     let element = selectedElements[0];
     if (element._shell)
       element._shell.doDefaultCommand();
+  },
+
+  onScroll: function DPV_onScroll() {
+    this._ensureVisibleElementsAreActive();
   }
 };
 
diff --git a/browser/components/downloads/content/allDownloadsViewOverlay.xul b/browser/components/downloads/content/allDownloadsViewOverlay.xul
index a4221cf4e01e..bad89005996c 100644
--- a/browser/components/downloads/content/allDownloadsViewOverlay.xul
+++ b/browser/components/downloads/content/allDownloadsViewOverlay.xul
@@ -42,6 +42,7 @@
   <richlistbox flex="1"
                seltype="multiple"
                id="downloadsRichListBox" context="downloadsContextMenu"
+               onscroll="return this._placesView.onScroll();"
                onkeypress="return this._placesView.onKeyPress(event);"
                ondblclick="return this._placesView.onDoubleClick(event);"
                oncontextmenu="return this._placesView.onContextMenu(event);"
diff --git a/browser/components/downloads/src/DownloadsCommon.jsm b/browser/components/downloads/src/DownloadsCommon.jsm
index 6867ceaef417..61b16c0b0c1b 100644
--- a/browser/components/downloads/src/DownloadsCommon.jsm
+++ b/browser/components/downloads/src/DownloadsCommon.jsm
@@ -437,7 +437,7 @@ this.DownloadsCommon = {
       }
 
       if (showAlert) {
-        let name = this.dataItem.target;
+        let name = aFile.leafName;
         let message =
           DownloadsCommon.strings.fileExecutableSecurityWarning(name, name);
         let title =
@@ -773,6 +773,11 @@ DownloadsDataCtor.prototype = {
   ensurePersistentDataLoaded:
   function DD_ensurePersistentDataLoaded(aActiveOnly)
   {
+    if (this == PrivateDownloadsData) {
+      Cu.reportError("ensurePersistentDataLoaded should not be called on PrivateDownloadsData");
+      return;
+    }
+
     if (this._pendingStatement) {
       // We are already in the process of reloading all downloads.
       return;
@@ -787,9 +792,7 @@ DownloadsDataCtor.prototype = {
 
         // Reload the list using the Download Manager service.  The list is
         // returned in no particular order.
-        let downloads = this._isPrivate ?
-                          Services.downloads.activePrivateDownloads :
-                          Services.downloads.activeDownloads;
+        let downloads = Services.downloads.activeDownloads;
         while (downloads.hasMoreElements()) {
           let download = downloads.getNext().QueryInterface(Ci.nsIDownload);
           this._getOrAddDataItem(download, true);
@@ -807,9 +810,7 @@ DownloadsDataCtor.prototype = {
         // columns are read in the _initFromDataRow method of DownloadsDataItem.
         // Order by descending download identifier so that the most recent
         // downloads are notified first to the listening views.
-        let dbConnection = this._isPrivate ?
-                             Services.downloads.privateDBConnection :
-                             Services.downloads.DBConnection;
+        let dbConnection = Services.downloads.DBConnection;
         let statement = dbConnection.createAsyncStatement(
           "SELECT guid, target, name, source, referrer, state, "
         +        "startTime, endTime, currBytes, maxBytes "
diff --git a/browser/components/places/content/downloadsViewOverlay.xul b/browser/components/places/content/downloadsViewOverlay.xul
index f383fbbeef76..1a44dfdc0c2f 100644
--- a/browser/components/places/content/downloadsViewOverlay.xul
+++ b/browser/components/places/content/downloadsViewOverlay.xul
@@ -19,7 +19,7 @@
       Components.interfaces.nsINavHistoryQueryOptions.SORT_BY_DATE_DESCENDING;
 
     ContentArea.setContentViewForQueryString(DOWNLOADS_QUERY,
-      function() new DownloadsPlacesView(document.getElementById("downloadsRichListBox")),
+      function() new DownloadsPlacesView(document.getElementById("downloadsRichListBox"), false),
       { showDetailsPane: false,
         toolbarSet: "back-button, forward-button, organizeButton, clearDownloadsButton, libraryToolbarSpacer, searchFilter" });
   ]]></script>
diff --git a/browser/components/places/content/places.js b/browser/components/places/content/places.js
index 38110aa3b13a..55c6483e7d6d 100644
--- a/browser/components/places/content/places.js
+++ b/browser/components/places/content/places.js
@@ -274,13 +274,8 @@ var PlacesOrganizer = {
    * Handle focus changes on the places list and the current content view.
    */
   updateDetailsPane: function PO_updateDetailsPane() {
-    let detailsDeck = document.getElementById("detailsDeck");
-    let detailsPaneDisabled = detailsDeck.hidden =
-      !ContentArea.currentViewOptions.showDetailsPane;
-    if (detailsPaneDisabled) {
+    if (!ContentArea.currentViewOptions.showDetailsPane)
       return;
-    }
-
     let view = PlacesUIUtils.getViewForNode(document.activeElement);
     if (view) {
       let selectedNodes = view.selectedNode ?
@@ -1278,7 +1273,7 @@ let ContentArea = {
       }
     }
     catch(ex) {
-      Cu.reportError(ex);
+      Components.utils.reportError(ex);
     }
     return ContentTree.view;
   },
@@ -1314,23 +1309,38 @@ let ContentArea = {
 
   get currentPlace() this.currentView.place,
   set currentPlace(aQueryString) {
-    this.currentView = this.getContentViewForQueryString(aQueryString);
-    this.currentView.place = aQueryString;
-    this._updateToolbarSet();
+    let oldView = this.currentView;
+    let newView = this.getContentViewForQueryString(aQueryString);
+    newView.place = aQueryString;
+    if (oldView != newView) {
+      oldView.active = false;
+      this.currentView = newView;
+      this._setupView();
+      newView.active = true;
+    }
     return aQueryString;
   },
 
-  _updateToolbarSet: function CA__updateToolbarSet() {
-    let toolbarSet = this.currentViewOptions.toolbarSet;
+  /**
+   * Applies view options.
+   */
+  _setupView: function CA__setupView() {
+    let options = this.currentViewOptions;
+
+    // showDetailsPane.
+    let detailsDeck = document.getElementById("detailsDeck");
+    detailsDeck.hidden = !options.showDetailsPane;
+
+    // toolbarSet.
     for (let elt of this._toolbar.childNodes) {
       // On Windows and Linux the menu buttons are menus wrapped in a menubar.
       if (elt.id == "placesMenu") {
         for (let menuElt of elt.childNodes) {
-          menuElt.hidden = toolbarSet.indexOf(menuElt.id) == -1;
+          menuElt.hidden = options.toolbarSet.indexOf(menuElt.id) == -1;
         }
       }
       else {
-        elt.hidden = toolbarSet.indexOf(elt.id) == -1;
+        elt.hidden = options.toolbarSet.indexOf(elt.id) == -1;
       }
     }
   },
diff --git a/browser/components/places/content/tree.xml b/browser/components/places/content/tree.xml
index 235f4bc68bf1..b0f995750650 100644
--- a/browser/components/places/content/tree.xml
+++ b/browser/components/places/content/tree.xml
@@ -674,6 +674,12 @@
       <property name="ownerWindow"
                 readonly="true"
                 onget="return window;"/>
+
+      <field name="_active">true</field>
+      <property name="active"
+                onget="return this._active"
+                onset="return this._active = val"/>
+
     </implementation>
     <handlers>
       <handler event="focus"><![CDATA[
diff --git a/browser/config/mozconfigs/win64/debug b/browser/config/mozconfigs/win64/debug
index b21ee05f4081..1bbca84e73b7 100644
--- a/browser/config/mozconfigs/win64/debug
+++ b/browser/config/mozconfigs/win64/debug
@@ -13,9 +13,6 @@ if test -z "${_PYMAKE}"; then
   mk_add_options MOZ_MAKE_FLAGS=-j1
 fi
 
-# Treat warnings as errors in directories with FAIL_ON_WARNINGS.
-ac_add_options --enable-warnings-as-errors
-
 # Package js shell.
 export MOZ_PACKAGE_JSSHELL=1
 
diff --git a/browser/config/mozconfigs/win64/nightly b/browser/config/mozconfigs/win64/nightly
index d3adcb087f66..1cb7f4be5576 100644
--- a/browser/config/mozconfigs/win64/nightly
+++ b/browser/config/mozconfigs/win64/nightly
@@ -22,9 +22,6 @@ if test -z "${_PYMAKE}"; then
   mk_add_options MOZ_MAKE_FLAGS=-j1
 fi
 
-# Treat warnings as errors in directories with FAIL_ON_WARNINGS.
-ac_add_options --enable-warnings-as-errors
-
 # Package js shell.
 export MOZ_PACKAGE_JSSHELL=1
 
diff --git a/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js b/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js
index e440239ccf99..6739cb1a76b9 100644
--- a/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js
+++ b/browser/devtools/debugger/test/browser_dbg_bug723069_editor-breakpoints.js
@@ -219,7 +219,6 @@ function test()
       info("switch to the second script");
 
       gScripts._container.selectedIndex = 0;
-      gDebugger.DebuggerController.SourceScripts.onChange({ target: gScripts._container });
     });
   }
 
diff --git a/browser/devtools/debugger/test/browser_dbg_scripts-searching-01.js b/browser/devtools/debugger/test/browser_dbg_scripts-searching-01.js
index 8e76e13c469a..23273944635d 100644
--- a/browser/devtools/debugger/test/browser_dbg_scripts-searching-01.js
+++ b/browser/devtools/debugger/test/browser_dbg_scripts-searching-01.js
@@ -20,6 +20,8 @@ function test()
   let scriptShown = false;
   let framesAdded = false;
 
+  requestLongerTimeout(2);
+
   debug_tab_pane(STACK_URL, function(aTab, aDebuggee, aPane) {
     gTab = aTab;
     gDebuggee = aDebuggee;
diff --git a/browser/devtools/jar.mn b/browser/devtools/jar.mn
index f50bfaad6c99..1d405fff06f3 100644
--- a/browser/devtools/jar.mn
+++ b/browser/devtools/jar.mn
@@ -27,7 +27,7 @@ browser.jar:
     content/browser/debugger-view.js              (debugger/debugger-view.js)
     content/browser/debugger-toolbar.js           (debugger/debugger-toolbar.js)
     content/browser/debugger-panes.js             (debugger/debugger-panes.js)
-*   content/browser/profiler.xul                  (profiler/profiler.xul)
+    content/browser/profiler.xul                  (profiler/profiler.xul)
     content/browser/profiler.css                  (profiler/profiler.css)
     content/browser/devtools/cleopatra.html       (profiler/cleopatra/cleopatra.html)
     content/browser/devtools/profiler/cleopatra/css/ui.css              (profiler/cleopatra/css/ui.css)
diff --git a/browser/themes/gnomestripe/browser.css b/browser/themes/gnomestripe/browser.css
index 474bcb3e0f12..b99fcbac29b8 100644
--- a/browser/themes/gnomestripe/browser.css
+++ b/browser/themes/gnomestripe/browser.css
@@ -2344,29 +2344,8 @@ html|*#gcli-output-frame {
   -moz-margin-end: 2px;
 }
 
-#social-toolbar-item {
-  -moz-box-orient: horizontal;
-}
-
-#social-toolbar-item > .toolbarbutton-1 {
-  margin: 0;
-  padding: 0;
-  -moz-appearance: toolbarbutton;
-}
-
-.social-notification-icon-hbox {
-  pointer-events: none;
-}
-
-.social-status-button {
-  list-style-image: none;
-}
-
-#social-provider-button {
-  -moz-image-region: rect(0, 16px, 16px, 0);
-}
-
-#social-provider-button > image {
+#social-toolbar-item > .toolbarbutton-1 > .toolbarbutton-icon,
+.social-notification-container > .toolbarbutton-1 > .toolbarbutton-icon {
   margin: 5px 3px;
 }
 
@@ -2374,33 +2353,32 @@ html|*#gcli-output-frame {
   display: none;
 }
 
-.social-notification-icon-stack {
-  padding: 0;
+.social-notification-container {
+  /* position:relative on .toolbarbutton-1 does not get position:absolute
+     to work as expected on .toolbarbutton-1 generated content. Placing a
+     simple container outside of .toolbarbutton-1 and setting position:relative
+     on the simple container however will work. */
+  position: relative;
 }
 
-.social-notification-icon-image {
-  margin: 5px 3px;
-  -moz-image-region: rect(0, 16px, 16px, 0);
-}
-
-.social-notification-icon-hbox {
-  padding: 0;
-}
-
-.social-notification-icon-label {
-  background-color: rgb(240,61,37);
-  border: 1px solid rgb(216,55,34);
-  box-shadow: 0px 1px 0px rgba(0,39,121,0.77);
-  padding-right: 1px;
-  padding-left: 1px;
-  color: white;
+.social-notification-container > .toolbarbutton-1[badge]:not([badge=""])::after {
+  /* The |content| property is set in the content stylesheet. */
   font-size: 9px;
   font-weight: bold;
-  margin: 0;
+  padding: 0 1px;
+  color: #fff;
+  background-color: rgb(240,61,37);
+  border: 1px solid rgb(216,55,34);
+  border-radius: 2px;
+  box-shadow: 0 1px 0 rgba(0,39,121,0.77);
+  position: absolute;
+  top: 2px;
+  right: 2px;
 }
 
-.social-notification-icon-label[value=""] {
-  display: none;
+.social-notification-container > .toolbarbutton-1[badge]:not([badge=""]):-moz-locale-dir(rtl)::after {
+  left: 2px;
+  right: auto;
 }
 
 /* social toolbar provider menu */
diff --git a/browser/themes/gnomestripe/preferences/preferences.css b/browser/themes/gnomestripe/preferences/preferences.css
index 0e644dabbdec..55cc2c8fd152 100644
--- a/browser/themes/gnomestripe/preferences/preferences.css
+++ b/browser/themes/gnomestripe/preferences/preferences.css
@@ -60,11 +60,11 @@ radio[pane=paneSync] {
 /* styles for the link elements copied from .text-link in global.css */
 .inline-link {
   color: -moz-nativehyperlinktext;
-  text-decoration: underline;
+  text-decoration: none;
 }
-  
-.inline-link:not(:focus) {
-  outline: 1px dotted transparent;
+
+.inline-link:hover {
+  text-decoration: underline;
 }
 
 /* Modeless Window Dialogs */
diff --git a/browser/themes/pinstripe/browser.css b/browser/themes/pinstripe/browser.css
index 48648df5778c..f13de6ceaa42 100644
--- a/browser/themes/pinstripe/browser.css
+++ b/browser/themes/pinstripe/browser.css
@@ -2392,7 +2392,7 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
   text-shadow: inherit;
 }
 
-#navigator-toolbox[tabsontop="true"]:not(:-moz-lwtheme)::before {
+#main-window:not([privatebrowsingmode=temporary]) #navigator-toolbox[tabsontop="true"]:not(:-moz-lwtheme)::before {
   /* We want the titlebar to be unified, but we still want to be able
    * to give #TabsToolbar a background. So we can't set -moz-appearance:
    * toolbar on #TabsToolbar itself. Instead, we set it on a box of the
@@ -3002,11 +3002,6 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
   }
 }
 
-#notification-popup .text-link, .panel-arrowcontent .text-link {
-  color: #0073e6;
-  text-decoration: none;
-}
-
 #geolocation-learnmore-link {
   -moz-margin-start: 0; /* override default label margin to match description margin */
 }
@@ -3100,7 +3095,6 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
 .popup-notification-icon[popupid="geolocation"] {
   list-style-image: url(chrome://browser/skin/Geolocation-64.png);
 }
-
 @media (min-resolution: 2dppx) {
   .popup-notification-icon[popupid="geolocation"] {
     list-style-image: url(chrome://browser/skin/Geolocation-64@2x.png);
@@ -3171,6 +3165,12 @@ toolbarbutton.chevron > .toolbarbutton-menu-dropmarker {
 .popup-notification-icon[popupid="webRTC-shareDevices"] {
   list-style-image: url(chrome://browser/skin/webRTC-shareDevice-64.png);
 }
+@media (min-resolution: 2dppx) {
+  .popup-notification-icon[popupid="webRTC-sharingDevices"],
+  .popup-notification-icon[popupid="webRTC-shareDevices"] {
+    list-style-image: url(chrome://browser/skin/webRTC-shareDevice-64@2x.png);
+  }
+}
 
 /* Popup Buttons */
 #identity-popup-more-info-button {
@@ -3803,30 +3803,16 @@ html|*#gcli-output-frame {
 
 /* === social toolbar button === */
 
-/* button icon for the service */
+toolbar[mode="icons"] > *|* > .social-notification-container {
+  -moz-appearance: toolbarbutton;
+}
+
+.social-notification-container > .toolbarbutton-1 {
+  -moz-appearance: none;
+}
+
 #social-toolbar-item {
-  -moz-box-orient: horizontal;
-}
-
-#social-toolbar-item > .toolbarbutton-1:not(:first-child):not(:last-child) {
-  margin-left: 0;
-  margin-right: 0;
-}
-
-#social-toolbar-item > .toolbarbutton-1:first-child {
-  -moz-margin-end: 0;
-}
-
-#social-toolbar-item > .toolbarbutton-1:last-child {
-  -moz-margin-start: 0;
-}
-
-.social-notification-icon-hbox {
-  pointer-events: none;
-}
-
-.social-status-button {
-  list-style-image: none;
+  margin: 0 4px;
 }
 
 #social-provider-button {
@@ -3837,39 +3823,40 @@ html|*#gcli-output-frame {
   display: none;
 }
 
-.social-notification-icon-stack {
-  padding: 0;
+.social-notification-container {
+  /* position:relative on .toolbarbutton-1 does not get position:absolute
+     to work as expected on .toolbarbutton-1 generated content. Placing a
+     simple container outside of .toolbarbutton-1 and setting position:relative
+     on the simple container however will work. */
+  position: relative;
 }
 
-.social-notification-icon-hbox {
-  padding: 0;
-}
-.social-notification-icon-label {
-  text-align: end;
+.social-notification-container > .toolbarbutton-1[badge]:not([badge=""])::after {
+  /* The |content| property is set in the content stylesheet. */
   font-size: 9px;
   font-weight: bold;
   padding: 0 1px;
-  color: white;
-  margin: 0;
+  color: #fff;
   background-color: rgb(240,61,37);
   border: 1px solid rgb(216,55,34);
+  border-radius: 2px;
   box-shadow: 0 1px 0 rgba(0,39,121,0.77);
-  -moz-margin-end: -4px;
-  margin-top: -4px;
+  position: absolute;
+  top: 2px;
+  right: 0;
 }
 
-.social-notification-icon-label[value=""] {
-  display: none;
+.social-notification-container > .toolbarbutton-1[badge]:not([badge=""]):-moz-locale-dir(rtl)::after {
+  left: 0;
+  right: auto;
 }
 
-@media (-moz-mac-lion-theme) {
-  .social-notification-icon-stack > image:-moz-window-inactive {
-    opacity: .5;
-  }
+toolbar[mode="icons"] > *|* > .social-notification-container > .toolbarbutton-1[badge]:not([badge=""])::after {
+  right: -2px;
 }
 
-.social-notification-icon-image {
-  -moz-image-region: rect(0, 16px, 16px, 0);
+toolbar[mode="icons"] > *|* > .social-notification-container > .toolbarbutton-1[badge]:not([badge=""]):-moz-locale-dir(rtl)::after {
+  left: -2px;
 }
 
 /* === end of social toolbar button === */
@@ -4161,3 +4148,27 @@ panel[type="arrow"][popupid="click-to-play-plugins"] > .panel-arrowcontainer > .
 .center-item-button {
   min-width: 0;
 }
+
+%ifdef MOZ_PER_WINDOW_PRIVATE_BROWSING
+#main-window[privatebrowsingmode=temporary] {
+  background-image: url("chrome://browser/skin/privatebrowsing-mask.png");
+  background-position: top right;
+  background-repeat: no-repeat;
+  background-color: -moz-mac-chrome-active;
+}
+
+@media (-moz-mac-lion-theme) {
+  #main-window[privatebrowsingmode=temporary] {
+    background-position: top right 40px;
+  }
+
+  #main-window[privatebrowsingmode=temporary]:-moz-locale-dir(rtl) {
+    background-position: top left 70px;
+  }
+}
+
+#main-window[privatebrowsingmode=temporary]:-moz-window-inactive {
+  background-color: -moz-mac-chrome-inactive;
+}
+%endif
+
diff --git a/browser/themes/pinstripe/jar.mn b/browser/themes/pinstripe/jar.mn
index 965bd2a44c52..62723370d0a1 100644
--- a/browser/themes/pinstripe/jar.mn
+++ b/browser/themes/pinstripe/jar.mn
@@ -48,6 +48,7 @@ browser.jar:
   skin/classic/browser/pageInfo.css
   skin/classic/browser/Privacy-16.png
   skin/classic/browser/Privacy-48.png
+  skin/classic/browser/privatebrowsing-mask.png
   skin/classic/browser/reload-stop-go.png
   skin/classic/browser/reload-stop-go@2x.png
   skin/classic/browser/searchbar-dropmarker.png
@@ -70,6 +71,7 @@ browser.jar:
   skin/classic/browser/webRTC-shareDevice-16.png
   skin/classic/browser/webRTC-shareDevice-16@2x.png
   skin/classic/browser/webRTC-shareDevice-64.png
+  skin/classic/browser/webRTC-shareDevice-64@2x.png
   skin/classic/browser/downloads/buttons.png                (downloads/buttons.png)
   skin/classic/browser/downloads/download-glow.png          (downloads/download-glow.png)
   skin/classic/browser/downloads/download-glow@2x.png       (downloads/download-glow@2x.png)
diff --git a/browser/themes/pinstripe/preferences/preferences.css b/browser/themes/pinstripe/preferences/preferences.css
index d5846c77a209..043534fc16b3 100644
--- a/browser/themes/pinstripe/preferences/preferences.css
+++ b/browser/themes/pinstripe/preferences/preferences.css
@@ -163,11 +163,11 @@ caption {
 /* styles for the link elements copied from .text-link in global.css */
 .inline-link {
   color: -moz-nativehyperlinktext;
-  text-decoration: underline;
+  text-decoration: none;
 }
-  
-.inline-link:not(:focus) {
-  outline: 1px dotted transparent;
+
+.inline-link:hover {
+  text-decoration: underline;
 }
 
 /**
diff --git a/browser/themes/pinstripe/privatebrowsing-mask.png b/browser/themes/pinstripe/privatebrowsing-mask.png
new file mode 100644
index 000000000000..92f60e29f9fd
Binary files /dev/null and b/browser/themes/pinstripe/privatebrowsing-mask.png differ
diff --git a/browser/themes/pinstripe/webRTC-shareDevice-64@2x.png b/browser/themes/pinstripe/webRTC-shareDevice-64@2x.png
new file mode 100644
index 000000000000..82e591f614f8
Binary files /dev/null and b/browser/themes/pinstripe/webRTC-shareDevice-64@2x.png differ
diff --git a/browser/themes/winstripe/browser.css b/browser/themes/winstripe/browser.css
index 9325e8c69ab6..a06fd09865d6 100644
--- a/browser/themes/winstripe/browser.css
+++ b/browser/themes/winstripe/browser.css
@@ -727,7 +727,8 @@ toolbar[mode=full] .toolbarbutton-1 > .toolbarbutton-menubutton-button {
 }
 
 @navbarLargeIcons@ .toolbarbutton-1:not(:hover):not(:active):not([open]) > .toolbarbutton-menubutton-dropmarker::before,
-@navbarLargeIcons@ > #social-toolbar-item > .toolbarbutton-1:not(:hover) + .toolbarbutton-1:not(:hover)::before {
+@navbarLargeIcons@ > #social-toolbar-item > .toolbarbutton-1:not(:hover) + .social-notification-container:not(:hover) > .toolbarbutton-1::before,
+@navbarLargeIcons@ > #social-toolbar-item > .social-notification-container:not(:hover) + .social-notification-container:not(:hover) > .toolbarbutton-1::before {
   content: "";
   display: -moz-box;
   width: 1px;
@@ -3028,6 +3029,7 @@ html|*#gcli-output-frame {
 }
 
 /* Social toolbar item */
+
 #social-provider-button {
   -moz-image-region: rect(0, 16px, 16px, 0);
 }
@@ -3036,47 +3038,47 @@ html|*#gcli-output-frame {
   display: none;
 }
 
-#social-toolbar-item > .toolbarbutton-1 {
-  padding: 5px;
-  -moz-appearance: toolbarbutton;
+@navbarLargeIcons@ > #social-toolbar-item > .toolbarbutton-1,
+@navbarLargeIcons@ > #social-toolbar-item > .social-notification-container > .toolbarbutton-1 {
+  padding-left: 0;
+  padding-right: 0;
 }
 
-@navbarLargeIcons@ > #social-toolbar-item > .toolbarbutton-1 {
-  padding: 6px 0;
+@navbarLargeIcons@ > #social-toolbar-item {
+  margin-left: 5px;
+  margin-right: 5px;
 }
 
-@navbarLargeIcons@ > #social-toolbar-item > .toolbarbutton-1:first-child {
-  -moz-padding-start: 5px;
+.social-notification-container {
+  /* position:relative on .toolbarbutton-1 does not get position:absolute
+     to work as expected on .toolbarbutton-1 generated content. Placing a
+     simple container outside of .toolbarbutton-1 and setting position:relative
+     on the simple container however will work. */
+  position: relative;
 }
 
-@navbarLargeIcons@ > #social-toolbar-item > .toolbarbutton-1:last-child {
-  -moz-padding-end: 5px;
-}
-
-.social-notification-icon-hbox {
-  pointer-events: none;
-  margin-top: -5px;
-  -moz-margin-end: -12px;
-}
-
-.social-notification-icon-label {
-  text-align: end;
+.social-notification-container > .toolbarbutton-1[badge]:not([badge=""])::after {
+  /* The |content| property is set in the content stylesheet. */
   font-size: 9px;
   font-weight: bold;
   padding: 0 1px;
-  color: white;
+  color: #fff;
   background-color: rgb(240,61,37);
   border: 1px solid rgb(216,55,34);
   border-radius: 2px;
   box-shadow: 0 1px 0 rgba(0,39,121,0.77);
+  position: absolute;
+  top: 2px;
+  right: 2px;
 }
 
-.social-notification-icon-label[value=""] {
-  display: none;
+@navbarLargeIcons@ > *|* > .social-notification-container > .toolbarbutton-1[badge]:not([badge=""])::after {
+  top: 7px;
 }
 
-.social-notification-icon-image {
-  -moz-image-region: rect(0, 16px, 16px, 0);
+.social-notification-container > .toolbarbutton-1[badge]:not([badge=""]):-moz-locale-dir(rtl)::after {
+  left: 2px;
+  right: auto;
 }
 
 /* social toolbar provider menu */
@@ -3377,3 +3379,20 @@ chatbox[minimized="true"] {
 .center-item-button {
   min-width: 0;
 }
+
+%ifdef MOZ_PER_WINDOW_PRIVATE_BROWSING
+#main-window[privatebrowsingmode=temporary] #toolbar-menubar {
+  background-image: url("chrome://browser/skin/privatebrowsing-dark.png");
+  background-position: top right;
+  background-repeat: no-repeat;
+}
+
+#main-window[privatebrowsingmode=temporary] #toolbar-menubar:-moz-locale-dir(rtl) {
+  background-position: top left;
+}
+
+#main-window[privatebrowsingmode=temporary] #appmenu-button {
+  list-style-image: url("chrome://browser/skin/privatebrowsing-light.png");
+}
+%endif
+
diff --git a/browser/themes/winstripe/jar.mn b/browser/themes/winstripe/jar.mn
index 0204bb3bfa1a..44565cab0984 100644
--- a/browser/themes/winstripe/jar.mn
+++ b/browser/themes/winstripe/jar.mn
@@ -44,6 +44,8 @@ browser.jar:
         skin/classic/browser/page-livemarks.png                      (feeds/feedIcon16.png)
         skin/classic/browser/Privacy-16.png
         skin/classic/browser/Privacy-48.png
+        skin/classic/browser/privatebrowsing-light.png
+        skin/classic/browser/privatebrowsing-dark.png
         skin/classic/browser/reload-stop-go.png
         skin/classic/browser/searchbar.css
         skin/classic/browser/searchbar-dropdown-arrow.png
@@ -266,6 +268,8 @@ browser.jar:
         skin/classic/aero/browser/page-livemarks.png                 (feeds/feedIcon16-aero.png)
         skin/classic/aero/browser/Privacy-16.png                     (Privacy-16-aero.png)
         skin/classic/aero/browser/Privacy-48.png                     (Privacy-48-aero.png)
+        skin/classic/aero/browser/privatebrowsing-light.png
+        skin/classic/aero/browser/privatebrowsing-dark.png
         skin/classic/aero/browser/reload-stop-go.png
         skin/classic/aero/browser/searchbar.css
         skin/classic/aero/browser/searchbar-dropdown-arrow.png       (searchbar-dropdown-arrow-aero.png)
diff --git a/browser/themes/winstripe/preferences/preferences.css b/browser/themes/winstripe/preferences/preferences.css
index ddfeb9977cda..5067fe635123 100644
--- a/browser/themes/winstripe/preferences/preferences.css
+++ b/browser/themes/winstripe/preferences/preferences.css
@@ -59,11 +59,11 @@ radio[pane=paneSync] {
 /* styles for the link elements copied from .text-link in global.css */
 .inline-link {
   color: -moz-nativehyperlinktext;
-  text-decoration: underline;
+  text-decoration: none;
 }
 
-.inline-link:not(:focus) {
-  outline: 1px dotted transparent;
+.inline-link:hover {
+  text-decoration: underline;
 }
 
 /* Modeless Window Dialogs */
diff --git a/browser/themes/winstripe/privatebrowsing-dark.png b/browser/themes/winstripe/privatebrowsing-dark.png
new file mode 100644
index 000000000000..9eaf3aec7e71
Binary files /dev/null and b/browser/themes/winstripe/privatebrowsing-dark.png differ
diff --git a/browser/themes/winstripe/privatebrowsing-light.png b/browser/themes/winstripe/privatebrowsing-light.png
new file mode 100644
index 000000000000..c12f50779858
Binary files /dev/null and b/browser/themes/winstripe/privatebrowsing-light.png differ
diff --git a/build/mobile/sutagent/android/DoCommand.java b/build/mobile/sutagent/android/DoCommand.java
index a3fc0d260e5e..e5200a78dcea 100755
--- a/build/mobile/sutagent/android/DoCommand.java
+++ b/build/mobile/sutagent/android/DoCommand.java
@@ -107,7 +107,7 @@ public class DoCommand {
     String ffxProvider = "org.mozilla.ffxcp";
     String fenProvider = "org.mozilla.fencp";
 
-    private final String prgVersion = "SUTAgentAndroid Version 1.15";
+    private final String prgVersion = "SUTAgentAndroid Version 1.16";
 
     public enum Command
         {
@@ -3414,7 +3414,7 @@ private void CancelNotification()
             else
                 prgIntent.setAction(Intent.ACTION_MAIN);
 
-            if (sArgs[0].contains("fennec"))
+            if (sArgs[0].contains("fennec") || sArgs[0].contains("firefox"))
                 {
                 sArgList = "";
                 sUrl = "";
diff --git a/build/win32/mozconfig.vs2010-win64 b/build/win32/mozconfig.vs2010-win64
index a9156a28aac2..8fbe98f8ff3c 100644
--- a/build/win32/mozconfig.vs2010-win64
+++ b/build/win32/mozconfig.vs2010-win64
@@ -1,9 +1,18 @@
-export INCLUDE=/c/tools/msvs10/vc/include:/c/tools/msvs10/vc/atlmfc/include:/c/tools/sdks/v7.0/include:/c/tools/sdks/v7.0/include/atl:/c/tools/sdks/dx10/include
-export LIBPATH=/c/tools/msvs10/vc/lib:/c/tools/msvs10/vc/atlmfc/lib
-export LIB=/c/tools/msvs10/vc/lib:/c/tools/msvs10/vc/atlmfc/lib:/c/tools/sdks/v7.0/lib:/c/tools/sdks/dx10/lib
+## SDK redist ##
 export WIN32_REDIST_DIR=/c/tools/msvs10/VC/redist/x86/Microsoft.VC100.CRT
+
+## moz tools location for 64-bit builders ##
 export MOZ_TOOLS=C:/mozilla-build/moztools
-export PATH="/c/tools/msvs10/Common7/IDE:/c/tools/msvs10/VC/BIN:/c/tools/msvs10/Common7/Tools:/c/tools/msvs10/VC/VCPackages:/c/mozilla-build/moztools:/c/Tools/sdks/v7.0/bin:${PATH}"
+
+## includes: win8 sdk includes, winrt headers for metro, msvc 10 std library, directx sdk for d3d9 ##
+export INCLUDE=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/shared:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/um:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/winrt:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/winrt/wrl:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/winrt/wrl/wrappers:/c/tools/msvs10/vc/include:/c/tools/msvs10/vc/atlmfc/include:/c/tools/sdks/dx10/include
+
+## libs: win8 sdk x86 (32-bit) libs, msvc 10 (32-bit) std library, msvc 10 atl libs, directx sdk (32-bit) for d3d9  ##
+export LIBPATH=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/Lib/win8/um/x86:/c/tools/msvs10/vc/lib:/c/tools/msvs10/vc/atlmfc/lib:/c/tools/sdks/dx10/lib
+export LIB=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/Lib/win8/um/x86:/c/tools/msvs10/vc/lib:/c/tools/msvs10/vc/atlmfc/lib:/c/tools/sdks/dx10/lib
+
+## paths: win8 sdk x86 (32-bit) tools, msvc 10 (32-bit) build toolchain, moz tools  ##
+export PATH="/c/Program Files (x86)/Windows Kits/8.0/bin/x86:/c/tools/msvs10/Common7/IDE:/c/tools/msvs10/VC/BIN:/c/tools/msvs10/Common7/Tools:/c/tools/msvs10/VC/VCPackages:/c/mozilla-build/moztools:${PATH}"
 
 . $topsrcdir/build/mozconfig.vs2010-common
 
diff --git a/build/win64/mozconfig.vs2010 b/build/win64/mozconfig.vs2010
index fe9093be4b10..d82bada4c438 100644
--- a/build/win64/mozconfig.vs2010
+++ b/build/win64/mozconfig.vs2010
@@ -1,9 +1,16 @@
-export INCLUDE=/c/tools/msvs10/vc/include:/c/tools/msvs10/vc/atlmfc/include:/c/tools/sdks/v7.0/include:/c/tools/sdks/v7.0/include/atl:/c/tools/sdks/dx10/include
-export LIBPATH=/c/tools/msvs10/vc/lib/amd64:/c/tools/msvs10/vc/atlmfc/lib/amd64
-export LIB=/c/tools/msvs10/vc/lib/amd64:/c/tools/msvs10/vc/atlmfc/lib/amd64:/c/tools/sdks/v7.0/lib/x64:/c/tools/sdks/dx10/lib/x64
-export PATH="/c/tools/msvs10/Common7/IDE:/c/tools/msvs10/VC/BIN/amd64:/c/tools/msvs10/VC/BIN/x86_amd64:/c/tools/msvs10/VC/BIN:/c/tools/msvs10/Common7/Tools:/c/tools/msvs10/VC/VCPackages:${PATH}"
+## SDK redist ##
 export WIN32_REDIST_DIR=/c/tools/msvs10/VC/redist/x64/Microsoft.VC100.CRT
 
+## includes: win8 sdk includes, winrt headers for metro, msvc 10 std library, directx sdk for d3d9 ##
+export INCLUDE=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/shared:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/um:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/winrt:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/winrt/wrl:/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/include/winrt/wrl/wrappers:/c/tools/msvs10/vc/include:/c/tools/msvs10/vc/atlmfc/include:/c/tools/sdks/dx10/include
+
+## libs: win8 sdk x64 (64-bit) libs, msvc 10 (64-bit) std library, msvc 10 atl libs, directx sdk (64-bit) for d3d9  ##
+export LIBPATH=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/Lib/win8/um/x64:/c/tools/msvs10/vc/lib/amd64:/c/tools/msvs10/vc/atlmfc/lib/amd64:/c/tools/sdks/dx10/lib/x64
+export LIB=/c/Program\ Files\ \(x86\)/Windows\ Kits/8.0/Lib/win8/um/x64:/c/tools/msvs10/vc/lib/amd64:/c/tools/msvs10/vc/atlmfc/lib/amd64:/c/tools/sdks/dx10/lib/x64
+
+## paths: win8 sdk x64 (64-bit) tools, msvc 10 (64-bit) build toolchain, moz tools  ##
+export PATH="/c/Program Files (x86)/Windows Kits/8.0/bin/x64:/c/tools/msvs10/Common7/IDE:/c/tools/msvs10/VC/BIN/amd64:/c/tools/msvs10/VC/BIN/x86_amd64:/c/tools/msvs10/VC/BIN:/c/tools/msvs10/Common7/Tools:/c/tools/msvs10/VC/VCPackages:${PATH}"
+
 # Use 32bit linker for PGO crash bug.
 # https://connect.microsoft.com/VisualStudio/feedback/details/686117/
 export LD=c:/tools/msvs10/VC/BIN/x86_amd64/link.exe
diff --git a/caps/idl/nsIPrincipal.idl b/caps/idl/nsIPrincipal.idl
index 8f009f996dcc..640e957904fe 100644
--- a/caps/idl/nsIPrincipal.idl
+++ b/caps/idl/nsIPrincipal.idl
@@ -21,7 +21,7 @@ interface nsIContentSecurityPolicy;
 [ptr] native JSPrincipals(JSPrincipals);
 [ptr] native PrincipalArray(nsTArray<nsCOMPtr<nsIPrincipal> >);
 
-[scriptable, builtinclass, uuid(011966C0-8564-438D-B37A-08D7E1195E5A)]
+[scriptable, builtinclass, uuid(dbda8bb0-3023-4aec-ad98-8e9931a29d70)]
 interface nsIPrincipal : nsISerializable
 {
     /**
@@ -153,6 +153,13 @@ interface nsIPrincipal : nsISerializable
      */
     readonly attribute AUTF8String extendedOrigin;
 
+    /**
+     * The base domain of the codebase URI to which this principal pertains
+     * (generally the document URI), handling null principals and
+     * non-hierarchical schemes correctly.
+     */
+    readonly attribute ACString baseDomain;
+    
     const short APP_STATUS_NOT_INSTALLED = 0;
     const short APP_STATUS_INSTALLED     = 1;
     const short APP_STATUS_PRIVILEGED    = 2;
diff --git a/caps/include/nsPrincipal.h b/caps/include/nsPrincipal.h
index 53255826086d..46c6510560c2 100644
--- a/caps/include/nsPrincipal.h
+++ b/caps/include/nsPrincipal.h
@@ -72,6 +72,7 @@ public:
   NS_IMETHOD GetIsInBrowserElement(bool* aIsInBrowserElement);
   NS_IMETHOD GetUnknownAppId(bool* aUnknownAppId);
   NS_IMETHOD GetIsNullPrincipal(bool* aIsNullPrincipal);
+  NS_IMETHOD GetBaseDomain(nsACString& aBaseDomain);
 #ifdef DEBUG
   virtual void dumpImpl();
 #endif
@@ -154,6 +155,7 @@ public:
   NS_IMETHOD GetIsInBrowserElement(bool* aIsInBrowserElement);
   NS_IMETHOD GetUnknownAppId(bool* aUnknownAppId);
   NS_IMETHOD GetIsNullPrincipal(bool* aIsNullPrincipal);
+  NS_IMETHOD GetBaseDomain(nsACString& aBaseDomain);
 #ifdef DEBUG
   virtual void dumpImpl();
 #endif
diff --git a/caps/src/nsNullPrincipal.cpp b/caps/src/nsNullPrincipal.cpp
index c1996efeff99..3f710d84e431 100644
--- a/caps/src/nsNullPrincipal.cpp
+++ b/caps/src/nsNullPrincipal.cpp
@@ -298,6 +298,13 @@ nsNullPrincipal::GetIsNullPrincipal(bool* aIsNullPrincipal)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsNullPrincipal::GetBaseDomain(nsACString& aBaseDomain)
+{
+  // For a null principal, we use our unique uuid as the base domain.
+  return mURI->GetPath(aBaseDomain);
+}
+
 /**
  * nsISerializable implementation
  */
diff --git a/caps/src/nsPrincipal.cpp b/caps/src/nsPrincipal.cpp
index 575467183f64..082d22a9e253 100644
--- a/caps/src/nsPrincipal.cpp
+++ b/caps/src/nsPrincipal.cpp
@@ -4,6 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "mozIThirdPartyUtil.h"
 #include "nscore.h"
 #include "nsScriptSecurityManager.h"
 #include "nsString.h"
@@ -441,7 +442,7 @@ nsPrincipal::CheckMayLoad(nsIURI* aURI, bool aReport, bool aAllowIfInheritsPrinc
       nsScriptSecurityManager::ReportError(
         nullptr, NS_LITERAL_STRING("CheckSameOriginError"), mCodebase, aURI);
     }
-    
+
     return NS_ERROR_DOM_BAD_URI;
   }
 
@@ -485,7 +486,7 @@ nsPrincipal::SetDomain(nsIURI* aDomain)
 {
   mDomain = NS_TryToMakeImmutable(aDomain);
   mDomainImmutable = URIIsImmutable(mDomain);
-  
+
   // Domain has changed, forget cached security policy
   SetSecurityPolicy(nullptr);
 
@@ -556,6 +557,29 @@ nsPrincipal::GetIsNullPrincipal(bool* aIsNullPrincipal)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsPrincipal::GetBaseDomain(nsACString& aBaseDomain)
+{
+  // For a file URI, we return the file path.
+  if (URIIsLocalFile(mCodebase)) {
+    nsCOMPtr<nsIURL> url = do_QueryInterface(mCodebase);
+
+    if (url) {
+      return url->GetFilePath(aBaseDomain);
+    }
+  }
+
+  // For everything else, we ask the TLD service via
+  // the ThirdPartyUtil.
+  nsCOMPtr<mozIThirdPartyUtil> thirdPartyUtil =
+    do_GetService(THIRDPARTYUTIL_CONTRACTID);
+  if (thirdPartyUtil) {
+    return thirdPartyUtil->GetBaseDomain(mCodebase, aBaseDomain);
+  }
+
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 nsPrincipal::Read(nsIObjectInputStream* aStream)
 {
@@ -688,20 +712,20 @@ nsExpandedPrincipal::nsExpandedPrincipal(nsTArray<nsCOMPtr <nsIPrincipal> > &aWh
 nsExpandedPrincipal::~nsExpandedPrincipal()
 { }
 
-NS_IMETHODIMP 
+NS_IMETHODIMP
 nsExpandedPrincipal::GetDomain(nsIURI** aDomain)
 {
   *aDomain = nullptr;
   return NS_OK;
 }
 
-NS_IMETHODIMP 
+NS_IMETHODIMP
 nsExpandedPrincipal::SetDomain(nsIURI* aDomain)
 {
   return NS_OK;
 }
 
-NS_IMETHODIMP 
+NS_IMETHODIMP
 nsExpandedPrincipal::GetOrigin(char** aOrigin)
 {
   *aOrigin = ToNewCString(NS_LITERAL_CSTRING(EXPANDED_PRINCIPAL_SPEC));
@@ -713,10 +737,10 @@ typedef nsresult (NS_STDCALL nsIPrincipal::*nsIPrincipalMemFn)(nsIPrincipal* aOt
 #define CALL_MEMBER_FUNCTION(THIS,MEM_FN)  ((THIS)->*(MEM_FN))
 
 // nsExpandedPrincipal::Equals and nsExpandedPrincipal::EqualsIgnoringDomain
-// shares the same logic. The difference only that Equals requires 'this' 
-// and 'aOther' to Subsume each other while EqualsIgnoringDomain requires 
+// shares the same logic. The difference only that Equals requires 'this'
+// and 'aOther' to Subsume each other while EqualsIgnoringDomain requires
 // bidirectional SubsumesIgnoringDomain.
-static nsresult 
+static nsresult
 Equals(nsExpandedPrincipal* aThis, nsIPrincipalMemFn aFn, nsIPrincipal* aOther,
        bool* aResult)
 {
@@ -750,14 +774,14 @@ nsExpandedPrincipal::EqualsIgnoringDomain(nsIPrincipal* aOther, bool* aResult)
 // nsExpandedPrincipal::Subsumes and nsExpandedPrincipal::SubsumesIgnoringDomain
 // shares the same logic. The difference only that Subsumes calls are replaced
 //with SubsumesIgnoringDomain calls in the second case.
-static nsresult 
-Subsumes(nsExpandedPrincipal* aThis, nsIPrincipalMemFn aFn, nsIPrincipal* aOther, 
+static nsresult
+Subsumes(nsExpandedPrincipal* aThis, nsIPrincipalMemFn aFn, nsIPrincipal* aOther,
          bool* aResult)
 {
   nsresult rv;
-  nsCOMPtr<nsIExpandedPrincipal> expanded = do_QueryInterface(aOther);  
+  nsCOMPtr<nsIExpandedPrincipal> expanded = do_QueryInterface(aOther);
   if (expanded) {
-    // If aOther is an ExpandedPrincipal too, check if all of its 
+    // If aOther is an ExpandedPrincipal too, check if all of its
     // principals are subsumed.
     nsTArray< nsCOMPtr<nsIPrincipal> >* otherList;
     expanded->GetWhiteList(&otherList);
@@ -766,7 +790,7 @@ Subsumes(nsExpandedPrincipal* aThis, nsIPrincipalMemFn aFn, nsIPrincipal* aOther
       NS_ENSURE_SUCCESS(rv, rv);
       if (!*aResult) {
         // If we don't subsume at least one principal of aOther, return false.
-        return NS_OK;    
+        return NS_OK;
       }
     }
   } else {
@@ -826,7 +850,7 @@ nsExpandedPrincipal::GetURI(nsIURI** aURI)
   return NS_OK;
 }
 
-NS_IMETHODIMP 
+NS_IMETHODIMP
 nsExpandedPrincipal::GetWhiteList(nsTArray<nsCOMPtr<nsIPrincipal> >** aWhiteList)
 {
   *aWhiteList = &mPrincipals;
@@ -874,6 +898,12 @@ nsExpandedPrincipal::GetIsNullPrincipal(bool* aIsNullPrincipal)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsExpandedPrincipal::GetBaseDomain(nsACString& aBaseDomain)
+{
+  return NS_ERROR_NOT_AVAILABLE;
+}
+
 void
 nsExpandedPrincipal::GetScriptLocation(nsACString& aStr)
 {
diff --git a/caps/src/nsSystemPrincipal.cpp b/caps/src/nsSystemPrincipal.cpp
index ddc310c908a0..3003dd4b0f7b 100644
--- a/caps/src/nsSystemPrincipal.cpp
+++ b/caps/src/nsSystemPrincipal.cpp
@@ -205,6 +205,13 @@ nsSystemPrincipal::GetIsNullPrincipal(bool* aIsNullPrincipal)
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsSystemPrincipal::GetBaseDomain(nsACString& aBaseDomain)
+{
+  // No base domain for chrome.
+  return NS_OK;
+}
+
 //////////////////////////////////////////
 // Methods implementing nsISerializable //
 //////////////////////////////////////////
diff --git a/configure.in b/configure.in
index b21073581bfc..0417559c25ef 100644
--- a/configure.in
+++ b/configure.in
@@ -7296,7 +7296,7 @@ dnl our own linker.
 if test "$OS_TARGET" = Android; then
     WRAP_LDFLAGS="${WRAP_LDFLAGS} -L$_objdir/dist/lib -lmozglue"
     WRAP_LDFLAGS="${WRAP_LDFLAGS} -Wl,--wrap=getaddrinfo,--wrap=freeaddrinfo,--wrap=gai_strerror"
-    WRAP_LDFLAGS="${WRAP_LDFLAGS} -Wl--wrap=PR_GetEnv,--wrap=PR_SetEnv"
+    WRAP_LDFLAGS="${WRAP_LDFLAGS} -Wl,--wrap=PR_GetEnv,--wrap=PR_SetEnv"
     if test -z "$gonkdir"; then
         WRAP_LDFLAGS="${WRAP_LDFLAGS} -Wl,--wrap=fork,--wrap=pthread_atfork,--wrap=raise"
         WRAP_LDFLAGS="${WRAP_LDFLAGS} -Wl,--wrap=memccpy,--wrap=memchr,--wrap=memrchr,--wrap=memcmp,--wrap=memcpy,--wrap=memmove,--wrap=memset,--wrap=memmem,--wrap=memswap,--wrap=index,--wrap=strchr,--wrap=strrchr,--wrap=strlen,--wrap=strcmp,--wrap=strcpy,--wrap=strcat,--wrap=strcasecmp,--wrap=strncasecmp,--wrap=strstr,--wrap=strcasestr,--wrap=strtok,--wrap=strtok_r,--wrap=strerror,--wrap=strerror_r,--wrap=strnlen,--wrap=strncat,--wrap=strncmp,--wrap=strncpy,--wrap=strlcat,--wrap=strlcpy,--wrap=strcspn,--wrap=strpbrk,--wrap=strsep,--wrap=strspn,--wrap=strcoll,--wrap=strxfrm"
diff --git a/content/base/crashtests/824719.html b/content/base/crashtests/824719.html
new file mode 100644
index 000000000000..3749b0ec08e0
--- /dev/null
+++ b/content/base/crashtests/824719.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+<div id='console'></div>
+<div id='parentDiv'>
+<div id='right-to-left1' dir=auto class=testElement>
+<input type=text value="a">a
+</div>
+<div id='right-to-left2' dir=auto class=testElement>
+</div>
+</div>
+
+<script type="text/javascript"> 
+
+document.getElementById("right-to-left2").appendChild(document.createElement("p"))
+var test5=document.getElementById("right-to-left1")
+var test6=document.getElementById("console").appendChild(document.createElement("dl"))
+
+test6.appendChild(document.createElement("img"))
+
+test5.parentNode.removeChild(test5)
+test5.innerHTML=''
+test5.appendChild(test6.cloneNode(true))
+</script>
+
+</body>
+</html>
diff --git a/content/base/crashtests/crashtests.list b/content/base/crashtests/crashtests.list
index a00756b41ce4..b749f29a93c7 100644
--- a/content/base/crashtests/crashtests.list
+++ b/content/base/crashtests/crashtests.list
@@ -123,3 +123,4 @@ load 815500.html
 load 816253.html
 load 822691.html
 load 822723.html
+load 824719.html
diff --git a/content/base/public/Element.h b/content/base/public/Element.h
index 5fabce8920db..39573f609b12 100644
--- a/content/base/public/Element.h
+++ b/content/base/public/Element.h
@@ -873,6 +873,29 @@ public:
    */
   nsIEditor* GetEditorInternal();
 
+  /**
+   * Helper method for NS_IMPL_BOOL_ATTR macro.
+   * Gets value of boolean attribute. Only works for attributes in null
+   * namespace.
+   *
+   * @param aAttr    name of attribute.
+   * @param aValue   Boolean value of attribute.
+   */
+  NS_HIDDEN_(bool) GetBoolAttr(nsIAtom* aAttr) const
+  {
+    return HasAttr(kNameSpaceID_None, aAttr);
+  }
+
+  /**
+   * Helper method for NS_IMPL_BOOL_ATTR macro.
+   * Sets value of boolean attribute by removing attribute or setting it to
+   * the empty string. Only works for attributes in null namespace.
+   *
+   * @param aAttr    name of attribute.
+   * @param aValue   Boolean value of attribute.
+   */
+  NS_HIDDEN_(nsresult) SetBoolAttr(nsIAtom* aAttr, bool aValue);
+
 protected:
   /*
    * Named-bools for use with SetAttrAndNotify to make call sites easier to
@@ -1215,6 +1238,24 @@ _elementName::Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const        \
     return SetAttr(kNameSpaceID_None, nsGkAtoms::_atom, nullptr, aValue, true); \
   }
 
+/**
+ * A macro to implement the getter and setter for a given boolean
+ * valued content property. The method uses the GetBoolAttr and
+ * SetBoolAttr methods.
+ */
+#define NS_IMPL_BOOL_ATTR(_class, _method, _atom)                     \
+  NS_IMETHODIMP                                                       \
+  _class::Get##_method(bool* aValue)                                  \
+  {                                                                   \
+    *aValue = GetBoolAttr(nsGkAtoms::_atom);                          \
+    return NS_OK;                                                     \
+  }                                                                   \
+  NS_IMETHODIMP                                                       \
+  _class::Set##_method(bool aValue)                                   \
+  {                                                                   \
+    return SetBoolAttr(nsGkAtoms::_atom, aValue);                     \
+  }
+
 #define NS_FORWARD_NSIDOMELEMENT_TO_GENERIC                                   \
 typedef mozilla::dom::Element Element;                                        \
 NS_IMETHOD GetTagName(nsAString& aTagName) MOZ_FINAL                          \
diff --git a/content/base/public/nsContentPolicyUtils.h b/content/base/public/nsContentPolicyUtils.h
index 595707b11f21..3c9e785d068c 100644
--- a/content/base/public/nsContentPolicyUtils.h
+++ b/content/base/public/nsContentPolicyUtils.h
@@ -144,7 +144,7 @@ NS_CP_ContentTypeName(uint32_t contentType)
  *
  * Note: requestOrigin is scoped outside the PR_BEGIN_MACRO/PR_END_MACRO on
  * purpose */
-#define CHECK_PRINCIPAL                                                       \
+#define CHECK_PRINCIPAL_AND_DATA(action)                                      \
   nsCOMPtr<nsIURI> requestOrigin;                                             \
   PR_BEGIN_MACRO                                                              \
   if (originPrincipal) {                                                      \
@@ -153,12 +153,32 @@ NS_CP_ContentTypeName(uint32_t contentType)
           secMan = do_GetService(NS_SCRIPTSECURITYMANAGER_CONTRACTID);        \
       }                                                                       \
       if (secMan) {                                                           \
-          bool isSystem;                                                    \
+          bool isSystem;                                                      \
           nsresult rv = secMan->IsSystemPrincipal(originPrincipal,            \
                                                   &isSystem);                 \
           NS_ENSURE_SUCCESS(rv, rv);                                          \
           if (isSystem) {                                                     \
               *decision = nsIContentPolicy::ACCEPT;                           \
+              nsCOMPtr<nsINode> n = do_QueryInterface(context);               \
+              if (!n) {                                                       \
+                  nsCOMPtr<nsPIDOMWindow> win = do_QueryInterface(context);   \
+                  n = win ? win->GetExtantDoc() : nullptr;                    \
+              }                                                               \
+              if (n) {                                                        \
+                  nsIDocument* d = n->OwnerDoc();                             \
+                  if (d->IsLoadedAsData() || d->IsBeingUsedAsImage() ||       \
+                      d->IsResourceDoc()) {                                   \
+                      nsCOMPtr<nsIContentPolicy> dataPolicy =                 \
+                          do_GetService(                                      \
+                              "@mozilla.org/data-document-content-policy;1"); \
+                      if (dataPolicy) {                                       \
+                          dataPolicy-> action (contentType, contentLocation,  \
+                                               requestOrigin, context,        \
+                                               mimeType, extra,               \
+                                               originPrincipal, decision);    \
+                      }                                                       \
+                  }                                                           \
+              }                                                               \
               return NS_OK;                                                   \
           }                                                                   \
       }                                                                       \
@@ -187,7 +207,7 @@ NS_CheckContentLoadPolicy(uint32_t          contentType,
                           nsIContentPolicy *policyService = nullptr,
                           nsIScriptSecurityManager* aSecMan = nullptr)
 {
-    CHECK_PRINCIPAL;
+    CHECK_PRINCIPAL_AND_DATA(ShouldLoad);
     if (policyService) {
         CHECK_CONTENT_POLICY_WITH_SERVICE(ShouldLoad, policyService);
     }
@@ -214,7 +234,7 @@ NS_CheckContentProcessPolicy(uint32_t          contentType,
                              nsIContentPolicy *policyService = nullptr,
                              nsIScriptSecurityManager* aSecMan = nullptr)
 {
-    CHECK_PRINCIPAL;
+    CHECK_PRINCIPAL_AND_DATA(ShouldProcess);
     if (policyService) {
         CHECK_CONTENT_POLICY_WITH_SERVICE(ShouldProcess, policyService);
     }
diff --git a/content/base/public/nsIDocument.h b/content/base/public/nsIDocument.h
index a8c45d36846e..73af8b9e30a8 100644
--- a/content/base/public/nsIDocument.h
+++ b/content/base/public/nsIDocument.h
@@ -46,7 +46,6 @@ class nsIDocumentObserver;
 class nsIDOMDocument;
 class nsIDOMDocumentFragment;
 class nsIDOMDocumentType;
-class nsXMLProcessingInstruction;
 class nsIDOMElement;
 class nsIDOMEventTarget;
 class nsIDOMNodeList;
@@ -74,6 +73,7 @@ class nsStyleSet;
 class nsTextNode;
 class nsWindowSizes;
 class nsSmallVoidArray;
+class nsDOMCaretPosition;
 
 namespace mozilla {
 class ErrorResult;
@@ -84,12 +84,14 @@ class ImageLoader;
 } // namespace css
 
 namespace dom {
+class CDATASection;
 class Comment;
 class DocumentFragment;
 class DocumentType;
 class DOMImplementation;
 class Element;
 class Link;
+class ProcessingInstruction;
 class UndoManager;
 template<typename> class Sequence;
 } // namespace dom
@@ -1825,7 +1827,7 @@ public:
                                               mozilla::ErrorResult& rv) const;
   already_AddRefed<mozilla::dom::Comment>
     CreateComment(const nsAString& aData, mozilla::ErrorResult& rv) const;
-  already_AddRefed<nsXMLProcessingInstruction>
+  already_AddRefed<mozilla::dom::ProcessingInstruction>
     CreateProcessingInstruction(const nsAString& target, const nsAString& data,
                                 mozilla::ErrorResult& rv) const;
   already_AddRefed<nsINode>
@@ -1842,7 +1844,7 @@ public:
                      nsIDOMNodeFilter* aFilter, mozilla::ErrorResult& rv) const;
 
   // Deprecated WebIDL bits
-  already_AddRefed<nsIDOMCDATASection>
+  already_AddRefed<mozilla::dom::CDATASection>
     CreateCDATASection(const nsAString& aData, mozilla::ErrorResult& rv);
   already_AddRefed<nsIDOMAttr>
     CreateAttribute(const nsAString& aName, mozilla::ErrorResult& rv);
@@ -1916,6 +1918,19 @@ public:
   virtual nsIDOMDOMStringList* StyleSheetSets() = 0;
   virtual void EnableStyleSheetsForSet(const nsAString& aSheetSet) = 0;
   Element* ElementFromPoint(float aX, float aY);
+
+  /**
+   * Retrieve the location of the caret position (DOM node and character
+   * offset within that node), given a point.
+   *
+   * @param aX Horizontal point at which to determine the caret position, in
+   *           page coordinates.
+   * @param aY Vertical point at which to determine the caret position, in
+   *           page coordinates.
+   */
+  already_AddRefed<nsDOMCaretPosition>
+    CaretPositionFromPoint(float aX, float aY);
+
   // QuerySelector and QuerySelectorAll already defined on nsINode
   nsINodeList* GetAnonymousNodes(Element& aElement);
   Element* GetAnonymousElementByAttribute(Element& aElement,
diff --git a/content/base/public/nsIMessageManager.idl b/content/base/public/nsIMessageManager.idl
index 766f8aacedf7..fc8cb671d26f 100644
--- a/content/base/public/nsIMessageManager.idl
+++ b/content/base/public/nsIMessageManager.idl
@@ -336,8 +336,8 @@ interface nsIFrameScriptLoader : nsISupports
   void removeDelayedFrameScript(in AString aURL);
 };
 
-[scriptable, builtinclass, uuid(5f552699-01a2-4f17-833b-ddb3fa0d98b2)]
-interface nsIPermissionChecker : nsISupports
+[scriptable, builtinclass, uuid(e2ccdade-4c16-11e2-9ae0-23151c6d6e1d)]
+interface nsIProcessChecker : nsISupports
 {
 
   /**
@@ -361,4 +361,25 @@ interface nsIPermissionChecker : nsISupports
    */
   boolean assertPermission(in DOMString aPermission);
 
+  /**
+   * Return true iff the "remote" process has |aManifestURL|.  This is
+   * intended to be used by JS implementations of cross-process DOM
+   * APIs, like so
+   *
+   *   recvFooRequest: function(message) {
+   *     if (!message.target.assertContainApp("foo")) {
+   *       return false;
+   *     }
+   *     // service foo request
+   *
+   * This interface only returns meaningful data when our content is
+   * in a separate process.  If it shares the same OS process as us,
+   * then applying this manifest URL check doesn't add any security,
+   * though it doesn't hurt anything either.
+   *
+   * Note: If the remote content process does *not* contain |aManifestURL|,
+   * it will be killed as a precaution.
+   */
+  boolean assertContainApp(in DOMString aManifestURL);
+
 };
diff --git a/content/base/public/nsINode.h b/content/base/public/nsINode.h
index 4b7772a05bfd..c59d8d31e2b5 100644
--- a/content/base/public/nsINode.h
+++ b/content/base/public/nsINode.h
@@ -1319,6 +1319,11 @@ private:
     NodeHasDirAuto,
     // Set if a node in the node's parent chain has dir=auto.
     NodeAncestorHasDirAuto,
+    // Set if the element is in the scope of a scoped style sheet; this flag is
+    // only accurate for elements bounds to a document
+    ElementIsInStyleScope,
+    // Set if the element is a scoped style sheet root
+    ElementIsScopedStyleRoot,
     // Guard value
     BooleanFlagCount
   };
@@ -1435,6 +1440,24 @@ public:
 
   bool NodeOrAncestorHasDirAuto() const
     { return HasDirAuto() || AncestorHasDirAuto(); }
+
+  void SetIsElementInStyleScope(bool aValue) {
+    MOZ_ASSERT(IsElement(), "SetIsInStyleScope on a non-Element node");
+    SetBoolFlag(ElementIsInStyleScope, aValue);
+  }
+  void SetIsElementInStyleScope() {
+    MOZ_ASSERT(IsElement(), "SetIsInStyleScope on a non-Element node");
+    SetBoolFlag(ElementIsInStyleScope);
+  }
+  void ClearIsElementInStyleScope() {
+    MOZ_ASSERT(IsElement(), "ClearIsInStyleScope on a non-Element node");
+    ClearBoolFlag(ElementIsInStyleScope);
+  }
+  bool IsElementInStyleScope() const { return GetBoolFlag(ElementIsInStyleScope); }
+
+  void SetIsScopedStyleRoot() { SetBoolFlag(ElementIsScopedStyleRoot); }
+  void ClearIsScopedStyleRoot() { ClearBoolFlag(ElementIsScopedStyleRoot); }
+  bool IsScopedStyleRoot() { return GetBoolFlag(ElementIsScopedStyleRoot); }
 protected:
   void SetParentIsContent(bool aValue) { SetBoolFlag(ParentIsContent, aValue); }
   void SetInDocument() { SetBoolFlag(IsInDocument); }
@@ -1455,7 +1478,7 @@ protected:
   bool HasLockedStyleStates() const
     { return GetBoolFlag(ElementHasLockedStyleStates); }
 
-    void SetSubtreeRootPointer(nsINode* aSubtreeRoot)
+  void SetSubtreeRootPointer(nsINode* aSubtreeRoot)
   {
     NS_ASSERTION(aSubtreeRoot, "aSubtreeRoot can never be null!");
     NS_ASSERTION(!(IsNodeOfType(eCONTENT) && IsInDoc()), "Shouldn't be here!");
diff --git a/content/base/src/Element.cpp b/content/base/src/Element.cpp
index c179df81afd9..2871ee368886 100644
--- a/content/base/src/Element.cpp
+++ b/content/base/src/Element.cpp
@@ -1155,6 +1155,9 @@ Element::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                NODE_NEEDS_FRAME | NODE_DESCENDANTS_NEED_FRAMES |
                // And the restyle bits
                ELEMENT_ALL_RESTYLE_FLAGS);
+
+    // Propagate scoped style sheet tracking bit.
+    SetIsElementInStyleScope(mParent->IsElementInStyleScope());
   } else {
     // If we're not in the doc, update our subtree pointer.
     SetSubtreeRootPointer(aParent->SubtreeRoot());
@@ -3595,3 +3598,13 @@ Element::GetEditorInternal()
   nsCOMPtr<nsITextControlElement> textCtrl = do_QueryInterface(this);
   return textCtrl ? textCtrl->GetTextEditor() : nullptr;
 }
+
+nsresult
+Element::SetBoolAttr(nsIAtom* aAttr, bool aValue)
+{
+  if (aValue) {
+    return SetAttr(kNameSpaceID_None, aAttr, EmptyString(), true);
+  }
+
+  return UnsetAttr(kNameSpaceID_None, aAttr, true);
+}
diff --git a/content/base/src/nsCCUncollectableMarker.cpp b/content/base/src/nsCCUncollectableMarker.cpp
index d26608e7549d..3041f991ab6f 100644
--- a/content/base/src/nsCCUncollectableMarker.cpp
+++ b/content/base/src/nsCCUncollectableMarker.cpp
@@ -368,12 +368,16 @@ nsCCUncollectableMarker::Observe(nsISupports* aSubject, const char* aTopic,
       MarkDocShell(shellTreeNode, cleanupJS, prepareForCC);
     }
 #ifdef MOZ_PER_WINDOW_PRIVATE_BROWSING
-    appShell->GetHiddenPrivateWindow(getter_AddRefs(hw));
-    if (hw) {
-      nsCOMPtr<nsIDocShell> shell;
-      hw->GetDocShell(getter_AddRefs(shell));
-      nsCOMPtr<nsIDocShellTreeNode> shellTreeNode = do_QueryInterface(shell);
-      MarkDocShell(shellTreeNode, cleanupJS, prepareForCC);
+    bool hasHiddenPrivateWindow = false;
+    appShell->GetHasHiddenPrivateWindow(&hasHiddenPrivateWindow);
+    if (hasHiddenPrivateWindow) {
+      appShell->GetHiddenPrivateWindow(getter_AddRefs(hw));
+      if (hw) {
+        nsCOMPtr<nsIDocShell> shell;
+        hw->GetDocShell(getter_AddRefs(shell));
+        nsCOMPtr<nsIDocShellTreeNode> shellTreeNode = do_QueryInterface(shell);
+        MarkDocShell(shellTreeNode, cleanupJS, prepareForCC);
+      }
     }
 #endif
   }
diff --git a/content/base/src/nsDataDocumentContentPolicy.cpp b/content/base/src/nsDataDocumentContentPolicy.cpp
index dcf420bc27df..843b3430aaec 100644
--- a/content/base/src/nsDataDocumentContentPolicy.cpp
+++ b/content/base/src/nsDataDocumentContentPolicy.cpp
@@ -30,6 +30,9 @@ HasFlags(nsIURI* aURI, uint32_t aURIFlags)
   return NS_SUCCEEDED(rv) && hasFlags;
 }
 
+// If you change DataDocumentContentPolicy, make sure to check that
+// CHECK_PRINCIPAL_AND_DATA in nsContentPolicyUtils is still valid.
+// nsContentPolicyUtils may not pass all the parameters to ShouldLoad.
 NS_IMETHODIMP
 nsDataDocumentContentPolicy::ShouldLoad(uint32_t aContentType,
                                         nsIURI *aContentLocation,
@@ -123,6 +126,10 @@ nsDataDocumentContentPolicy::ShouldLoad(uint32_t aContentType,
     *aDecision = nsIContentPolicy::REJECT_TYPE;
   }
 
+  // If you add more restrictions here, make sure to check that
+  // CHECK_PRINCIPAL_AND_DATA in nsContentPolicyUtils is still valid.
+  // nsContentPolicyUtils may not pass all the parameters to ShouldLoad
+
   return NS_OK;
 }
 
diff --git a/content/base/src/nsDocument.cpp b/content/base/src/nsDocument.cpp
index 3cf1e8bd782f..56438fa7c0db 100644
--- a/content/base/src/nsDocument.cpp
+++ b/content/base/src/nsDocument.cpp
@@ -45,8 +45,8 @@
 #include "nsIDOMDocumentXBL.h"
 #include "mozilla/dom/Element.h"
 #include "nsGenericHTMLElement.h"
-#include "nsIDOMCDATASection.h"
-#include "nsIDOMProcessingInstruction.h"
+#include "mozilla/dom/CDATASection.h"
+#include "mozilla/dom/ProcessingInstruction.h"
 #include "nsDOMString.h"
 #include "nsNodeUtils.h"
 #include "nsLayoutUtils.h" // for GetFrameForPoint
@@ -170,7 +170,6 @@
 #include "mozilla/dom/DOMImplementation.h"
 #include "mozilla/dom/Comment.h"
 #include "nsTextNode.h"
-#include "nsXMLProcessingInstruction.h"
 #include "mozilla/dom/Link.h"
 #include "nsXULAppAPI.h"
 #include "nsDOMTouchEvent.h"
@@ -2027,6 +2026,25 @@ nsDocument::ResetToURI(nsIURI *aURI, nsILoadGroup *aLoadGroup,
   }
 }
 
+void
+nsDocument::RemoveDocStyleSheetsFromStyleSets()
+{
+  // The stylesheets should forget us
+  int32_t indx = mStyleSheets.Count();
+  while (--indx >= 0) {
+    nsIStyleSheet* sheet = mStyleSheets[indx];
+    sheet->SetOwningDocument(nullptr);
+
+    if (sheet->IsApplicable()) {
+      nsCOMPtr<nsIPresShell> shell = GetShell();
+      if (shell) {
+        shell->StyleSet()->RemoveDocStyleSheet(sheet);
+      }
+    }
+    // XXX Tell observers?
+  }
+}
+
 void
 nsDocument::RemoveStyleSheetsFromStyleSets(nsCOMArray<nsIStyleSheet>& aSheets, nsStyleSet::sheetType aType)
 {
@@ -2054,7 +2072,7 @@ nsDocument::ResetStylesheetsToURI(nsIURI* aURI)
   NS_PRECONDITION(aURI, "Null URI passed to ResetStylesheetsToURI");
 
   mozAutoDocUpdate upd(this, UPDATE_STYLE, true);
-  RemoveStyleSheetsFromStyleSets(mStyleSheets, nsStyleSet::eDocSheet);
+  RemoveDocStyleSheetsFromStyleSets();
   RemoveStyleSheetsFromStyleSets(mCatalogSheets, nsStyleSet::eAgentSheet);
   RemoveStyleSheetsFromStyleSets(mAdditionalSheets[eAgentSheet], nsStyleSet::eAgentSheet);
   RemoveStyleSheetsFromStyleSets(mAdditionalSheets[eUserSheet], nsStyleSet::eUserSheet);
@@ -3503,7 +3521,7 @@ nsDocument::RemoveStyleSheetFromStyleSets(nsIStyleSheet* aSheet)
 {
   nsCOMPtr<nsIPresShell> shell = GetShell();
   if (shell) {
-    shell->StyleSet()->RemoveStyleSheet(nsStyleSet::eDocSheet, aSheet);
+    shell->StyleSet()->RemoveDocStyleSheet(aSheet);
   }
 }
 
@@ -4610,7 +4628,7 @@ nsDocument::CreateCDATASection(const nsAString& aData,
   return rv.ErrorCode();
 }
 
-already_AddRefed<nsIDOMCDATASection>
+already_AddRefed<CDATASection>
 nsIDocument::CreateCDATASection(const nsAString& aData,
                                 ErrorResult& rv)
 {
@@ -4635,8 +4653,7 @@ nsIDocument::CreateCDATASection(const nsAString& aData,
   // Don't notify; this node is still being created.
   content->SetText(aData, false);
 
-  nsCOMPtr<nsIDOMCDATASection> section = do_QueryInterface(content);
-  return section.forget();
+  return static_cast<CDATASection*>(content.forget().get());
 }
 
 NS_IMETHODIMP
@@ -4649,7 +4666,7 @@ nsDocument::CreateProcessingInstruction(const nsAString& aTarget,
   return rv.ErrorCode();
 }
 
-already_AddRefed<nsXMLProcessingInstruction>
+already_AddRefed<ProcessingInstruction>
 nsIDocument::CreateProcessingInstruction(const nsAString& aTarget,
                                          const nsAString& aData,
                                          mozilla::ErrorResult& rv) const
@@ -4673,7 +4690,7 @@ nsIDocument::CreateProcessingInstruction(const nsAString& aTarget,
     return nullptr;
   }
 
-  return static_cast<nsXMLProcessingInstruction*>(content.forget().get());
+  return static_cast<ProcessingInstruction*>(content.forget().get());
 }
 
 NS_IMETHODIMP
@@ -8853,32 +8870,29 @@ ResetFullScreen(nsIDocument* aDocument, void* aData)
   return true;
 }
 
-NS_IMETHODIMP
-nsDocument::CaretPositionFromPoint(float aX, float aY, nsISupports** aCaretPos)
+already_AddRefed<nsDOMCaretPosition>
+nsIDocument::CaretPositionFromPoint(float aX, float aY)
 {
-  NS_ENSURE_ARG_POINTER(aCaretPos);
-  *aCaretPos = nullptr;
-
   nscoord x = nsPresContext::CSSPixelsToAppUnits(aX);
   nscoord y = nsPresContext::CSSPixelsToAppUnits(aY);
   nsPoint pt(x, y);
 
   nsIPresShell *ps = GetShell();
   if (!ps) {
-    return NS_OK;
+    return nullptr;
   }
 
   nsIFrame *rootFrame = ps->GetRootFrame();
 
   // XUL docs, unlike HTML, have no frame tree until everything's done loading
   if (!rootFrame) {
-    return NS_OK; // return null to premature XUL callers as a reminder to wait
+    return nullptr;
   }
 
   nsIFrame *ptFrame = nsLayoutUtils::GetFrameForPoint(rootFrame, pt, true,
                                                       false);
   if (!ptFrame) {
-    return NS_OK;
+    return nullptr;
   }
 
   // GetContentOffsetsFromPoint requires frame-relative coordinates, so we need
@@ -8906,8 +8920,15 @@ nsDocument::CaretPositionFromPoint(float aX, float aY, nsISupports** aCaretPos)
     }
   }
 
-  *aCaretPos = new nsDOMCaretPosition(node, offset);
-  NS_ADDREF(*aCaretPos);
+  nsRefPtr<nsDOMCaretPosition> aCaretPos = new nsDOMCaretPosition(node, offset);
+  return aCaretPos.forget();
+}
+
+NS_IMETHODIMP
+nsDocument::CaretPositionFromPoint(float aX, float aY, nsISupports** aCaretPos)
+{
+  NS_ENSURE_ARG_POINTER(aCaretPos);
+  *aCaretPos = nsIDocument::CaretPositionFromPoint(aX, aY).get();
   return NS_OK;
 }
 
diff --git a/content/base/src/nsDocument.h b/content/base/src/nsDocument.h
index 9da0d22572f2..4185f9f224f0 100644
--- a/content/base/src/nsDocument.h
+++ b/content/base/src/nsDocument.h
@@ -1080,6 +1080,7 @@ protected:
                          nsCompatibility aCompatMode,
                          nsIPresShell** aInstancePtrResult);
 
+  void RemoveDocStyleSheetsFromStyleSets();
   void RemoveStyleSheetsFromStyleSets(nsCOMArray<nsIStyleSheet>& aSheets, 
                                       nsStyleSet::sheetType aType);
   nsresult ResetStylesheetsToURI(nsIURI* aURI);
diff --git a/content/base/src/nsFrameLoader.cpp b/content/base/src/nsFrameLoader.cpp
index 084e9c957414..b5cc1f171b37 100644
--- a/content/base/src/nsFrameLoader.cpp
+++ b/content/base/src/nsFrameLoader.cpp
@@ -77,7 +77,7 @@
 
 #include "Layers.h"
 
-#include "AppProcessPermissions.h"
+#include "AppProcessChecker.h"
 #include "ContentParent.h"
 #include "TabParent.h"
 #include "mozilla/GuardObjects.h"
@@ -2314,6 +2314,13 @@ nsFrameLoader::CheckPermission(const nsAString& aPermission)
                                     NS_ConvertUTF16toUTF8(aPermission).get());
 }
 
+bool
+nsFrameLoader::CheckManifestURL(const nsAString& aManifestURL)
+{
+  return AssertAppProcessManifestURL(GetRemoteBrowser(),
+                                     NS_ConvertUTF16toUTF8(aManifestURL).get());
+}
+
 NS_IMETHODIMP
 nsFrameLoader::GetMessageManager(nsIMessageSender** aManager)
 {
@@ -2550,6 +2557,12 @@ nsFrameLoader::AttributeChanged(nsIDocument* aDocument,
 void
 nsFrameLoader::ResetPermissionManagerStatus()
 {
+  // The resetting of the permissions status can run only
+  // in the main process.
+  if (XRE_GetProcessType() == GeckoProcessType_Content) {
+    return;
+  }
+
   // Finding the new app Id:
   // . first we check if the owner is an app frame
   // . second, we check if the owner is a browser frame
diff --git a/content/base/src/nsFrameLoader.h b/content/base/src/nsFrameLoader.h
index b52a1899dc8e..f6883f121426 100644
--- a/content/base/src/nsFrameLoader.h
+++ b/content/base/src/nsFrameLoader.h
@@ -189,7 +189,7 @@ public:
   virtual bool DoSendAsyncMessage(const nsAString& aMessage,
                                   const mozilla::dom::StructuredCloneData& aData);
   virtual bool CheckPermission(const nsAString& aPermission);
-
+  virtual bool CheckManifestURL(const nsAString& aManifestURL);
 
   /**
    * Called from the layout frame associated with this frame loader;
diff --git a/content/base/src/nsFrameMessageManager.cpp b/content/base/src/nsFrameMessageManager.cpp
index 4023f9508c06..e2fd1d62c8dd 100644
--- a/content/base/src/nsFrameMessageManager.cpp
+++ b/content/base/src/nsFrameMessageManager.cpp
@@ -7,7 +7,7 @@
 
 #include "nsFrameMessageManager.h"
 
-#include "AppProcessPermissions.h"
+#include "AppProcessChecker.h"
 #include "ContentChild.h"
 #include "ContentParent.h"
 #include "nsContentUtils.h"
@@ -107,8 +107,8 @@ NS_INTERFACE_MAP_BEGIN_CYCLE_COLLECTION(nsFrameMessageManager)
   NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsIFrameScriptLoader,
                                      mChrome && !mIsProcessManager)
 
-  /* Message senders in the chrome process support nsIPermissionChecker. */
-  NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsIPermissionChecker,
+  /* Message senders in the chrome process support nsIProcessChecker. */
+  NS_INTERFACE_MAP_ENTRY_CONDITIONAL(nsIProcessChecker,
                                      mChrome && !mIsBroadcaster)
 
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO_CONDITIONAL(ChromeMessageBroadcaster,
@@ -423,12 +423,14 @@ nsFrameMessageManager::Atob(const nsAString& aAsciiString,
   return NS_OK;
 }
 
-// nsIPermissionChecker
+// nsIProcessChecker
 
-NS_IMETHODIMP
-nsFrameMessageManager::AssertPermission(const nsAString& aPermission, bool* aHasPermission)
+nsresult
+nsFrameMessageManager::AssertProcessInternal(ProcessCheckerType aType,
+                                             const nsAString& aCapability,
+                                             bool* aValid)
 {
-  *aHasPermission = false;
+  *aValid = false;
 
   // This API is only supported for message senders in the chrome process.
   if (!mChrome || mIsBroadcaster) {
@@ -437,10 +439,37 @@ nsFrameMessageManager::AssertPermission(const nsAString& aPermission, bool* aHas
   if (!mCallback) {
     return NS_ERROR_NOT_AVAILABLE;
   }
-  *aHasPermission = mCallback->CheckPermission(aPermission);
+  switch (aType) {
+    case PROCESS_CHECKER_PERMISSION:
+      *aValid = mCallback->CheckPermission(aCapability);
+      break;
+    case PROCESS_CHECKER_MANIFEST_URL:
+      *aValid = mCallback->CheckManifestURL(aCapability);
+      break;
+    default:
+      break;
+  }
   return NS_OK;
 }
 
+NS_IMETHODIMP
+nsFrameMessageManager::AssertPermission(const nsAString& aPermission,
+                                        bool* aHasPermission)
+{
+  return AssertProcessInternal(PROCESS_CHECKER_PERMISSION,
+                               aPermission,
+                               aHasPermission);
+}
+
+NS_IMETHODIMP
+nsFrameMessageManager::AssertContainApp(const nsAString& aManifestURL,
+                                        bool* aHasManifestURL)
+{
+  return AssertProcessInternal(PROCESS_CHECKER_MANIFEST_URL,
+                               aManifestURL,
+                               aHasManifestURL);
+}
+
 class MMListenerRemover
 {
 public:
@@ -1100,6 +1129,11 @@ public:
     return true;
   }
 
+  bool CheckManifestURL(const nsAString& aManifestURL)
+  {
+    // In a single-process scenario, the child always has all capabilities.
+    return true;
+  }
 };
 
 
diff --git a/content/base/src/nsFrameMessageManager.h b/content/base/src/nsFrameMessageManager.h
index ae0825b3ed86..6ca9124372c4 100644
--- a/content/base/src/nsFrameMessageManager.h
+++ b/content/base/src/nsFrameMessageManager.h
@@ -66,6 +66,11 @@ public:
   {
     return false;
   }
+
+  virtual bool CheckManifestURL(const nsAString& aManifestURL)
+  {
+    return false;
+  }
 };
 
 } // namespace ipc
@@ -86,7 +91,7 @@ struct nsMessageListenerInfo
 class nsFrameMessageManager MOZ_FINAL : public nsIContentFrameMessageManager,
                                         public nsIMessageBroadcaster,
                                         public nsIFrameScriptLoader,
-                                        public nsIPermissionChecker
+                                        public nsIProcessChecker
 {
   typedef mozilla::dom::StructuredCloneData StructuredCloneData;
 public:
@@ -152,7 +157,7 @@ public:
   NS_DECL_NSISYNCMESSAGESENDER
   NS_DECL_NSICONTENTFRAMEMESSAGEMANAGER
   NS_DECL_NSIFRAMESCRIPTLOADER
-  NS_DECL_NSIPERMISSIONCHECKER
+  NS_DECL_NSIPROCESSCHECKER
 
   static nsFrameMessageManager*
   NewProcessMessageManager(mozilla::dom::ContentParent* aProcess);
@@ -226,6 +231,14 @@ public:
   static nsFrameMessageManager* sChildProcessManager;
   static nsFrameMessageManager* sSameProcessParentManager;
   static nsTArray<nsCOMPtr<nsIRunnable> >* sPendingSameProcessAsyncMessages;
+private:
+  enum ProcessCheckerType {
+    PROCESS_CHECKER_PERMISSION,
+    PROCESS_CHECKER_MANIFEST_URL
+  };
+  nsresult AssertProcessInternal(ProcessCheckerType aType,
+                                 const nsAString& aCapability,
+                                 bool* aValid);
 };
 
 void
diff --git a/content/base/src/nsStyleLinkElement.cpp b/content/base/src/nsStyleLinkElement.cpp
index d7294adc26d4..48e9ed03a0eb 100644
--- a/content/base/src/nsStyleLinkElement.cpp
+++ b/content/base/src/nsStyleLinkElement.cpp
@@ -12,9 +12,10 @@
 
 #include "nsStyleLinkElement.h"
 
-#include "nsIContent.h"
 #include "mozilla/css/Loader.h"
+#include "mozilla/dom/Element.h"
 #include "nsCSSStyleSheet.h"
+#include "nsIContent.h"
 #include "nsIDocument.h"
 #include "nsIDOMComment.h"
 #include "nsIDOMNode.h"
@@ -26,6 +27,9 @@
 #include "nsUnicharInputStream.h"
 #include "nsContentUtils.h"
 
+using namespace mozilla;
+using namespace mozilla::dom;
+
 nsStyleLinkElement::nsStyleLinkElement()
   : mDontLoadStyle(false)
   , mUpdatesEnabled(true)
@@ -203,6 +207,87 @@ nsStyleLinkElement::UpdateStyleSheetInternal(nsIDocument *aOldDocument,
                             aForceUpdate);
 }
 
+static bool
+IsScopedStyleElement(nsIContent* aContent)
+{
+  // This is quicker than, say, QIing aContent to nsStyleLinkElement
+  // and then calling its virtual GetStyleSheetInfo method to find out
+  // if it is scoped.
+  return aContent->IsHTML(nsGkAtoms::style) &&
+         aContent->HasAttr(kNameSpaceID_None, nsGkAtoms::scoped);
+}
+
+static void
+SetIsElementInStyleScopeFlagOnSubtree(Element* aElement)
+{
+  if (aElement->IsElementInStyleScope()) {
+    return;
+  }
+
+  aElement->SetIsElementInStyleScope();
+
+  nsIContent* n = aElement->GetNextNode(aElement);
+  while (n) {
+    if (n->IsElementInStyleScope()) {
+      n = n->GetNextNonChildNode(aElement);
+    } else {
+      if (n->IsElement()) {
+        n->SetIsElementInStyleScope();
+      }
+      n = n->GetNextNode(aElement);
+    }
+  }
+}
+
+static bool
+HasScopedStyleSheetChild(nsIContent* aContent)
+{
+  for (nsIContent* n = aContent->GetFirstChild(); n; n = n->GetNextSibling()) {
+    if (IsScopedStyleElement(n)) {
+      return true;
+    }
+  }
+  return false;
+}
+
+// Called when aElement has had a <style scoped> child removed.
+static void
+UpdateIsElementInStyleScopeFlagOnSubtree(Element* aElement)
+{
+  NS_ASSERTION(aElement->IsElementInStyleScope(),
+               "only call UpdateIsElementInStyleScopeFlagOnSubtree on a "
+               "subtree that has IsElementInStyleScope boolean flag set");
+
+  if (HasScopedStyleSheetChild(aElement)) {
+    return;
+  }
+
+  aElement->ClearIsElementInStyleScope();
+
+  nsIContent* n = aElement->GetNextNode(aElement);
+  while (n) {
+    if (HasScopedStyleSheetChild(n)) {
+      n = n->GetNextNonChildNode(aElement);
+    } else {
+      if (n->IsElement()) {
+        n->ClearIsElementInStyleScope();
+      }
+      n = n->GetNextNode(aElement);
+    }
+  }
+}
+
+static Element*
+GetScopeElement(nsIStyleSheet* aSheet)
+{
+  nsRefPtr<nsCSSStyleSheet> cssStyleSheet = do_QueryObject(aSheet);
+  if (!cssStyleSheet) {
+    return nullptr;
+  }
+
+  return cssStyleSheet->GetScopeElement();
+}
+
 nsresult
 nsStyleLinkElement::DoUpdateStyleSheet(nsIDocument *aOldDocument,
                                        nsICSSLoaderObserver* aObserver,
@@ -212,6 +297,11 @@ nsStyleLinkElement::DoUpdateStyleSheet(nsIDocument *aOldDocument,
 {
   *aWillNotify = false;
 
+  nsCOMPtr<nsIContent> thisContent;
+  CallQueryInterface(this, getter_AddRefs(thisContent));
+
+  Element* oldScopeElement = GetScopeElement(mStyleSheet);
+
   if (mStyleSheet && aOldDocument) {
     // We're removing the link element from the document, unload the
     // stylesheet.  We want to do this even if updates are disabled, since
@@ -221,15 +311,15 @@ nsStyleLinkElement::DoUpdateStyleSheet(nsIDocument *aOldDocument,
     aOldDocument->RemoveStyleSheet(mStyleSheet);
     aOldDocument->EndUpdate(UPDATE_STYLE);
     nsStyleLinkElement::SetStyleSheet(nullptr);
+    if (oldScopeElement) {
+      UpdateIsElementInStyleScopeFlagOnSubtree(oldScopeElement);
+    }
   }
 
   if (mDontLoadStyle || !mUpdatesEnabled) {
     return NS_OK;
   }
 
-  nsCOMPtr<nsIContent> thisContent;
-  QueryInterface(NS_GET_IID(nsIContent), getter_AddRefs(thisContent));
-
   NS_ENSURE_TRUE(thisContent, NS_ERROR_FAILURE);
 
   nsCOMPtr<nsIDocument> doc = thisContent->GetDocument();
@@ -264,14 +354,21 @@ nsStyleLinkElement::DoUpdateStyleSheet(nsIDocument *aOldDocument,
   }
 
   nsAutoString title, type, media;
+  bool isScoped;
   bool isAlternate;
 
-  GetStyleSheetInfo(title, type, media, &isAlternate);
+  GetStyleSheetInfo(title, type, media, &isScoped, &isAlternate);
 
   if (!type.LowerCaseEqualsLiteral("text/css")) {
     return NS_OK;
   }
 
+  Element* scopeElement = isScoped ? thisContent->GetParentElement() : nullptr;
+  if (scopeElement) {
+    NS_ASSERTION(isInline, "non-inline style must not have scope element");
+    SetIsElementInStyleScopeFlagOnSubtree(scopeElement);
+  }
+
   bool doneLoading = false;
   nsresult rv = NS_OK;
   if (isInline) {
@@ -281,7 +378,7 @@ nsStyleLinkElement::DoUpdateStyleSheet(nsIDocument *aOldDocument,
     // Parse the style sheet.
     rv = doc->CSSLoader()->
       LoadInlineStyle(thisContent, text, mLineNumber, title, media,
-                      aObserver, &doneLoading, &isAlternate);
+                      scopeElement, aObserver, &doneLoading, &isAlternate);
   }
   else {
     // XXXbz clone the URI here to work around content policies modifying URIs.
@@ -308,3 +405,44 @@ nsStyleLinkElement::DoUpdateStyleSheet(nsIDocument *aOldDocument,
 
   return NS_OK;
 }
+
+void
+nsStyleLinkElement::UpdateStyleSheetScopedness(bool aIsNowScoped)
+{
+  if (!mStyleSheet) {
+    return;
+  }
+
+  nsRefPtr<nsCSSStyleSheet> cssStyleSheet = do_QueryObject(mStyleSheet);
+  NS_ASSERTION(cssStyleSheet, "should only call UpdateStyleSheetScope for "
+                              "an nsCSSStyleSheet");
+
+  nsCOMPtr<nsIContent> thisContent;
+  CallQueryInterface(this, getter_AddRefs(thisContent));
+
+  Element* oldScopeElement = cssStyleSheet->GetScopeElement();
+  Element* newScopeElement = aIsNowScoped ?
+                               thisContent->GetParentElement() :
+                               nullptr;
+
+  if (oldScopeElement == newScopeElement) {
+    return;
+  }
+
+  nsIDocument* document = thisContent->GetOwnerDocument();
+
+  document->BeginUpdate(UPDATE_STYLE);
+  document->RemoveStyleSheet(mStyleSheet);
+
+  cssStyleSheet->SetScopeElement(newScopeElement);
+
+  document->AddStyleSheet(mStyleSheet);
+  document->EndUpdate(UPDATE_STYLE);
+
+  if (oldScopeElement) {
+    UpdateIsElementInStyleScopeFlagOnSubtree(oldScopeElement);
+  }
+  if (newScopeElement) {
+    SetIsElementInStyleScopeFlagOnSubtree(newScopeElement);
+  }
+}
diff --git a/content/base/src/nsStyleLinkElement.h b/content/base/src/nsStyleLinkElement.h
index b802f4a7c118..bf6fab086af8 100644
--- a/content/base/src/nsStyleLinkElement.h
+++ b/content/base/src/nsStyleLinkElement.h
@@ -69,10 +69,13 @@ protected:
   nsresult UpdateStyleSheetInternal(nsIDocument *aOldDocument,
                                     bool aForceUpdate = false);
 
+  void UpdateStyleSheetScopedness(bool aIsNowScoped);
+
   virtual already_AddRefed<nsIURI> GetStyleSheetURL(bool* aIsInline) = 0;
   virtual void GetStyleSheetInfo(nsAString& aTitle,
                                  nsAString& aType,
                                  nsAString& aMedia,
+                                 bool* aIsScoped,
                                  bool* aIsAlternate) = 0;
 
   nsIStyleSheet* GetStyleSheet() { return mStyleSheet; }
diff --git a/content/base/test/Makefile.in b/content/base/test/Makefile.in
index 41c8bd3ac67f..c9ffbee404d5 100644
--- a/content/base/test/Makefile.in
+++ b/content/base/test/Makefile.in
@@ -506,8 +506,8 @@ MOCHITEST_FILES_B = \
 		file_html_in_xhr3.html \
 		file_html_in_xhr.sjs \
 		test_bug647518.html \
-		test_bug654352.html \
-                Ahem.ttf \
+		test_caretPositionFromPoint.html \
+		Ahem.ttf \
 		test_bug664916.html \
 		test_bug666604.html \
 		test_bug675121.html \
diff --git a/content/base/test/test_bug654352.html b/content/base/test/test_caretPositionFromPoint.html
similarity index 84%
rename from content/base/test/test_bug654352.html
rename to content/base/test/test_caretPositionFromPoint.html
index 421031654b89..dda5828627ce 100644
--- a/content/base/test/test_bug654352.html
+++ b/content/base/test/test_caretPositionFromPoint.html
@@ -64,6 +64,16 @@
     checkOffsetsFromPoint(test4Rect.left + 1, test4Rect.top + 1, 0);
     checkOffsetsFromPoint(Math.round(test4Rect.left + convertEmToPx(3)), Math.round(test4Rect.top + 10), 3);
 
+    // Check to make sure that x or y outside the viewport returns null.
+    var nullCp1 = document.caretPositionFromPoint(-10, 0);
+    ok(!nullCp1, "caret position with negative x should be null");
+    var nullCp2 = document.caretPositionFromPoint(0, -10);
+    ok(!nullCp2, "caret position with negative y should be null");
+    var nullCp3 = document.caretPositionFromPoint(9000, 0);
+    ok(!nullCp3, "caret position with x > viewport width should be null");
+    var nullCp4 = document.caretPositionFromPoint(0, 9000);
+    ok(!nullCp4, "caret position with x > viewport height should be null");
+
     // Check the first and last characters of the marquee.
     SimpleTest.finish();
   }
diff --git a/content/base/test/test_messagemanager_assertpermission.html b/content/base/test/test_messagemanager_assertpermission.html
index 9a00da1a2a7f..5d76cf563488 100644
--- a/content/base/test/test_messagemanager_assertpermission.html
+++ b/content/base/test/test_messagemanager_assertpermission.html
@@ -2,7 +2,7 @@
 <html>
 <head>
   <meta charset="utf-8">
-  <title>Test for the nsIPermissionChecker part of Message Managers</title>
+  <title>Test for the nsIProcessChecker part of Message Managers</title>
   <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>        
   <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
 </head>
diff --git a/content/canvas/src/WebGLContextGL.cpp b/content/canvas/src/WebGLContextGL.cpp
index d003dd359d3f..935959498c41 100644
--- a/content/canvas/src/WebGLContextGL.cpp
+++ b/content/canvas/src/WebGLContextGL.cpp
@@ -3166,9 +3166,6 @@ WebGLContext::ReadPixels(WebGLint x, WebGLint y, WebGLsizei width,
     WebGLsizei framebufferWidth = framebufferRect ? framebufferRect->Width() : 0;
     WebGLsizei framebufferHeight = framebufferRect ? framebufferRect->Height() : 0;
 
-    uint32_t dataByteLen = JS_GetTypedArrayByteLength(pixels->Obj());
-    int dataType = JS_GetTypedArrayType(pixels->Obj());
-
     uint32_t channels = 0;
 
     // Check the format param
@@ -3205,6 +3202,8 @@ WebGLContext::ReadPixels(WebGLint x, WebGLint y, WebGLsizei width,
             return ErrorInvalidEnum("readPixels: Bad type");
     }
 
+    int dataType = JS_GetArrayBufferViewType(pixels->Obj());
+
     // Check the pixels param type
     if (dataType != requiredDataType)
         return ErrorInvalidOperation("readPixels: Mismatched type/pixels types");
@@ -3221,6 +3220,7 @@ WebGLContext::ReadPixels(WebGLint x, WebGLint y, WebGLsizei width,
     if (!checked_neededByteLength.isValid())
         return ErrorInvalidOperation("readPixels: integer overflow computing the needed buffer size");
 
+    uint32_t dataByteLen = JS_GetTypedArrayByteLength(pixels->Obj());
     if (checked_neededByteLength.value() > dataByteLen)
         return ErrorInvalidOperation("readPixels: buffer too small");
 
@@ -4890,7 +4890,7 @@ WebGLContext::TexImage2D(WebGLenum target, WebGLint level,
     return TexImage2D_base(target, level, internalformat, width, height, 0, border, format, type,
                            pixels ? pixels->Data() : 0,
                            pixels ? pixels->Length() : 0,
-                           pixels ? (int)JS_GetTypedArrayType(pixels->Obj()) : -1,
+                           pixels ? (int)JS_GetArrayBufferViewType(pixels->Obj()) : -1,
                            WebGLTexelConversions::Auto, false);
 }
 
@@ -5044,7 +5044,7 @@ WebGLContext::TexSubImage2D(WebGLenum target, WebGLint level,
     return TexSubImage2D_base(target, level, xoffset, yoffset,
                               width, height, 0, format, type,
                               pixels->Data(), pixels->Length(),
-                              JS_GetTypedArrayType(pixels->Obj()),
+                              JS_GetArrayBufferViewType(pixels->Obj()),
                               WebGLTexelConversions::Auto, false);
 }
 
diff --git a/content/events/test/test_eventctors.html b/content/events/test/test_eventctors.html
index f8edda702ac7..413d3086f60f 100644
--- a/content/events/test/test_eventctors.html
+++ b/content/events/test/test_eventctors.html
@@ -426,6 +426,10 @@ is(e.min, 0, "min should be 0");
 is(e.max, 2, "max should be 2");
 document.dispatchEvent(e);
 is(receivedEvent, e, "Wrong event!");
+e = new DeviceProximityEvent("hello");
+is(e.value, Infinity, "Uninitialized value should be infinity");
+is(e.min, -Infinity, "Uninitialized min should be -infinity");
+is(e.max, Infinity, "Uninitialized max should be infinity");
 
 // UserProximityEvent
 e = new UserProximityEvent("hello", {near: true});
diff --git a/content/html/content/src/HTMLSharedListElement.cpp b/content/html/content/src/HTMLSharedListElement.cpp
index 43cb4a2f0f4a..cad9ccd01a89 100644
--- a/content/html/content/src/HTMLSharedListElement.cpp
+++ b/content/html/content/src/HTMLSharedListElement.cpp
@@ -16,7 +16,9 @@
 #include "nsMappedAttributes.h"
 #include "nsRuleData.h"
 
-NS_IMPL_NS_NEW_HTML_ELEMENT(SharedList)
+NS_IMPL_NS_NEW_HTML_ELEMENT(OList)
+NS_IMPL_NS_NEW_HTML_ELEMENT(DList)
+NS_IMPL_NS_NEW_HTML_ELEMENT(UList)
 DOMCI_DATA(HTMLOListElement, mozilla::dom::HTMLSharedListElement)
 DOMCI_DATA(HTMLDListElement, mozilla::dom::HTMLSharedListElement)
 DOMCI_DATA(HTMLUListElement, mozilla::dom::HTMLSharedListElement)
@@ -62,7 +64,9 @@ NS_INTERFACE_TABLE_HEAD(HTMLSharedListElement)
 NS_HTML_CONTENT_INTERFACE_MAP_END
 
 
-NS_IMPL_ELEMENT_CLONE(HTMLSharedListElement)
+NS_IMPL_ELEMENT_CLONE(HTMLOListElement)
+NS_IMPL_ELEMENT_CLONE(HTMLDListElement)
+NS_IMPL_ELEMENT_CLONE(HTMLUListElement)
 
 
 NS_IMPL_BOOL_ATTR(HTMLSharedListElement, Compact, compact)
diff --git a/content/html/content/src/HTMLSharedListElement.h b/content/html/content/src/HTMLSharedListElement.h
index 8fe4b91bdc9c..a1a1b2e8c248 100644
--- a/content/html/content/src/HTMLSharedListElement.h
+++ b/content/html/content/src/HTMLSharedListElement.h
@@ -55,7 +55,6 @@ public:
                                 nsAttrValue& aResult);
   virtual nsMapRuleToAttributesFunc GetAttributeMappingFunction() const;
   NS_IMETHOD_(bool) IsAttributeMapped(const nsIAtom* aAttribute) const;
-  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
   virtual nsXPCClassInfo* GetClassInfo()
   {
     return static_cast<nsXPCClassInfo*>(GetClassInfoInternal());
@@ -99,10 +98,20 @@ public:
   {
     SetHTMLBoolAttr(nsGkAtoms::compact, aCompact, rv);
   }
+
+protected:
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
+                             bool *aTriedToWrap) MOZ_OVERRIDE = 0;
 };
 
 class HTMLDListElement MOZ_FINAL : public HTMLSharedListElement
 {
+public:
+  HTMLDListElement(already_AddRefed<nsINodeInfo> aNodeInfo)
+    : HTMLSharedListElement(aNodeInfo)
+  {
+  }
+  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 protected:
   virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
                              bool *aTriedToWrap) MOZ_OVERRIDE;
@@ -110,6 +119,12 @@ protected:
 
 class HTMLOListElement MOZ_FINAL : public HTMLSharedListElement
 {
+public:
+  HTMLOListElement(already_AddRefed<nsINodeInfo> aNodeInfo)
+    : HTMLSharedListElement(aNodeInfo)
+  {
+  }
+  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 protected:
   virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
                              bool *aTriedToWrap) MOZ_OVERRIDE;
@@ -117,6 +132,12 @@ protected:
 
 class HTMLUListElement MOZ_FINAL : public HTMLSharedListElement
 {
+public:
+  HTMLUListElement(already_AddRefed<nsINodeInfo> aNodeInfo)
+    : HTMLSharedListElement(aNodeInfo)
+  {
+  }
+  virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 protected:
   virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
                              bool *aTriedToWrap) MOZ_OVERRIDE;
diff --git a/content/html/content/src/nsGenericHTMLElement.cpp b/content/html/content/src/nsGenericHTMLElement.cpp
index d52947b19d9d..1106d1ec0729 100644
--- a/content/html/content/src/nsGenericHTMLElement.cpp
+++ b/content/html/content/src/nsGenericHTMLElement.cpp
@@ -1870,16 +1870,6 @@ nsGenericHTMLElement::SetAttrHelper(nsIAtom* aAttr, const nsAString& aValue)
   return SetAttr(kNameSpaceID_None, aAttr, aValue, true);
 }
 
-nsresult
-nsGenericHTMLElement::SetBoolAttr(nsIAtom* aAttr, bool aValue)
-{
-  if (aValue) {
-    return SetAttr(kNameSpaceID_None, aAttr, EmptyString(), true);
-  }
-
-  return UnsetAttr(kNameSpaceID_None, aAttr, true);
-}
-
 int32_t
 nsGenericHTMLElement::GetIntAttr(nsIAtom* aAttr, int32_t aDefault) const
 {
diff --git a/content/html/content/src/nsGenericHTMLElement.h b/content/html/content/src/nsGenericHTMLElement.h
index bb6f83268597..ae08966c0681 100644
--- a/content/html/content/src/nsGenericHTMLElement.h
+++ b/content/html/content/src/nsGenericHTMLElement.h
@@ -37,7 +37,6 @@ class nsHTMLFormElement;
 class nsIDOMHTMLMenuElement;
 class nsIDOMHTMLCollection;
 class nsDOMSettableTokenList;
-class nsIDOMDOMStringMap;
 
 namespace mozilla {
 namespace dom{
@@ -240,6 +239,11 @@ public:
     return style;
   }
 
+  /**
+   * Determine whether an attribute is an event (onclick, etc.)
+   * @param aName the attribute
+   * @return whether the name is an event handler name
+   */
   virtual bool IsEventAttributeName(nsIAtom* aName) MOZ_OVERRIDE;
 
 #define EVENT(name_, id_, type_, struct_) /* nothing; handled by nsINode */
@@ -773,13 +777,6 @@ private:
   void RegUnRegAccessKey(bool aDoReg);
 
 protected:
-  /**
-   * Determine whether an attribute is an event (onclick, etc.)
-   * @param aName the attribute
-   * @return whether the name is an event handler name
-   */
-  bool IsEventName(nsIAtom* aName);
-
   virtual nsresult BeforeSetAttr(int32_t aNamespaceID, nsIAtom* aName,
                                  const nsAttrValueOrString* aValue,
                                  bool aNotify);
@@ -851,29 +848,6 @@ protected:
    */
   NS_HIDDEN_(nsresult) SetAttrHelper(nsIAtom* aAttr, const nsAString& aValue);
 
-  /**
-   * Helper method for NS_IMPL_BOOL_ATTR macro.
-   * Gets value of boolean attribute. Only works for attributes in null
-   * namespace.
-   *
-   * @param aAttr    name of attribute.
-   * @param aValue   Boolean value of attribute.
-   */
-  NS_HIDDEN_(bool) GetBoolAttr(nsIAtom* aAttr) const
-  {
-    return HasAttr(kNameSpaceID_None, aAttr);
-  }
-
-  /**
-   * Helper method for NS_IMPL_BOOL_ATTR macro.
-   * Sets value of boolean attribute by removing attribute or setting it to
-   * the empty string. Only works for attributes in null namespace.
-   *
-   * @param aAttr    name of attribute.
-   * @param aValue   Boolean value of attribute.
-   */
-  NS_HIDDEN_(nsresult) SetBoolAttr(nsIAtom* aAttr, bool aValue);
-
   /**
    * Helper method for NS_IMPL_INT_ATTR macro.
    * Gets the integer-value of an attribute, returns specified default value
@@ -1236,24 +1210,6 @@ protected:
     return SetAttrHelper(nsGkAtoms::_atom, aValue);                          \
   }
 
-/**
- * A macro to implement the getter and setter for a given boolean
- * valued content property. The method uses the generic GetAttr and
- * SetAttr methods.
- */
-#define NS_IMPL_BOOL_ATTR(_class, _method, _atom)                     \
-  NS_IMETHODIMP                                                       \
-  _class::Get##_method(bool* aValue)                                \
-  {                                                                   \
-    *aValue = GetBoolAttr(nsGkAtoms::_atom);                          \
-    return NS_OK;                                                     \
-  }                                                                   \
-  NS_IMETHODIMP                                                       \
-  _class::Set##_method(bool aValue)                                 \
-  {                                                                   \
-    return SetBoolAttr(nsGkAtoms::_atom, aValue);                   \
-  }
-
 /**
  * A macro to implement the getter and setter for a given integer
  * valued content property. The method uses the generic GetAttr and
@@ -1910,7 +1866,6 @@ NS_NewHTMLElement(already_AddRefed<nsINodeInfo> aNodeInfo,
                   mozilla::dom::FromParser aFromParser = mozilla::dom::NOT_FROM_PARSER);
 
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Shared)
-NS_DECLARE_NS_NEW_HTML_ELEMENT(SharedList)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(SharedObject)
 
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Anchor)
@@ -1925,6 +1880,7 @@ NS_DECLARE_NS_NEW_HTML_ELEMENT(Canvas)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Mod)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(DataList)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Div)
+NS_DECLARE_NS_NEW_HTML_ELEMENT(DList)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(FieldSet)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Font)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Form)
@@ -1947,6 +1903,7 @@ NS_DECLARE_NS_NEW_HTML_ELEMENT(MenuItem)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Meta)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Meter)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Object)
+NS_DECLARE_NS_NEW_HTML_ELEMENT(OList)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(OptGroup)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Option)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Output)
@@ -1971,6 +1928,7 @@ NS_DECLARE_NS_NEW_HTML_ELEMENT(TextArea)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Tfoot)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Thead)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Title)
+NS_DECLARE_NS_NEW_HTML_ELEMENT(UList)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Unknown)
 #if defined(MOZ_MEDIA)
 NS_DECLARE_NS_NEW_HTML_ELEMENT(Video)
diff --git a/content/html/content/src/nsHTMLInputElement.cpp b/content/html/content/src/nsHTMLInputElement.cpp
index 2fe32b5d3538..1e86cea0cebb 100644
--- a/content/html/content/src/nsHTMLInputElement.cpp
+++ b/content/html/content/src/nsHTMLInputElement.cpp
@@ -1076,7 +1076,7 @@ nsHTMLInputElement::ConvertStringToNumber(nsAString& aValue,
           return false;
         }
 
-        break;
+        return true;
       }
     case NS_FORM_INPUT_DATE:
       {
@@ -1091,32 +1091,40 @@ nsHTMLInputElement::ConvertStringToNumber(nsAString& aValue,
         }
 
         JSObject* date = JS_NewDateObjectMsec(ctx, 0);
+        if (!date) {
+          JS_ClearPendingException(ctx);
+          return false;
+        }
+
         jsval rval;
         jsval fullYear[3];
         fullYear[0].setInt32(year);
         fullYear[1].setInt32(month-1);
         fullYear[2].setInt32(day);
         if (!JS::Call(ctx, date, "setUTCFullYear", 3, fullYear, &rval)) {
+          JS_ClearPendingException(ctx);
           return false;
         }
 
         jsval timestamp;
         if (!JS::Call(ctx, date, "getTime", 0, nullptr, &timestamp)) {
+          JS_ClearPendingException(ctx);
           return false;
         }
 
-        if (!timestamp.isNumber()) {
+        if (!timestamp.isNumber() || MOZ_DOUBLE_IS_NaN(timestamp.toNumber())) {
           return false;
         }
 
         aResultValue = timestamp.toNumber();
+        return true;
       }
-      break;
     default:
       return false;
   }
 
-  return true;
+  MOZ_NOT_REACHED();
+  return false;
 }
 
 double
@@ -1242,6 +1250,7 @@ nsHTMLInputElement::ConvertNumberToString(double aValue,
 
         JSObject* date = JS_NewDateObjectMsec(ctx, aValue);
         if (!date) {
+          JS_ClearPendingException(ctx);
           return false;
         }
 
@@ -1249,6 +1258,14 @@ nsHTMLInputElement::ConvertNumberToString(double aValue,
         if (!JS::Call(ctx, date, "getUTCFullYear", 0, nullptr, &year) ||
             !JS::Call(ctx, date, "getUTCMonth", 0, nullptr, &month) ||
             !JS::Call(ctx, date, "getUTCDate", 0, nullptr, &day)) {
+          JS_ClearPendingException(ctx);
+          return false;
+        }
+
+        if (!year.isNumber() || !month.isNumber() || !day.isNumber() ||
+            MOZ_DOUBLE_IS_NaN(year.toNumber()) ||
+            MOZ_DOUBLE_IS_NaN(month.toNumber()) ||
+            MOZ_DOUBLE_IS_NaN(day.toNumber())) {
           return false;
         }
 
@@ -1280,12 +1297,19 @@ nsHTMLInputElement::GetValueAsDate(JSContext* aCtx, jsval* aDate)
   }
 
   JSObject* date = JS_NewDateObjectMsec(aCtx, 0);
+  if (!date) {
+    JS_ClearPendingException(aCtx);
+    aDate->setNull();
+    return NS_OK;
+  }
+
   jsval rval;
   jsval fullYear[3];
   fullYear[0].setInt32(year);
   fullYear[1].setInt32(month-1);
   fullYear[2].setInt32(day);
   if(!JS::Call(aCtx, date, "setUTCFullYear", 3, fullYear, &rval)) {
+    JS_ClearPendingException(aCtx);
     aDate->setNull();
     return NS_OK;
   }
@@ -1301,15 +1325,22 @@ nsHTMLInputElement::SetValueAsDate(JSContext* aCtx, const jsval& aDate)
     return NS_ERROR_DOM_INVALID_STATE_ERR;
   }
 
+  if (aDate.isNullOrUndefined()) {
+    return SetValue(EmptyString());
+  }
+
+  // TODO: return TypeError when HTMLInputElement is converted to WebIDL, see
+  // bug 826302.
   if (!aDate.isObject() || !JS_ObjectIsDate(aCtx, &aDate.toObject())) {
     SetValue(EmptyString());
-    return NS_OK;
+    return NS_ERROR_INVALID_ARG;
   }
 
   JSObject& date = aDate.toObject();
   jsval timestamp;
-  bool ret = JS::Call(aCtx, &date, "getTime", 0, nullptr, &timestamp);
-  if (!ret || !timestamp.isNumber() || MOZ_DOUBLE_IS_NaN(timestamp.toNumber())) {
+  if (!JS::Call(aCtx, &date, "getTime", 0, nullptr, &timestamp) ||
+      !timestamp.isNumber() || MOZ_DOUBLE_IS_NaN(timestamp.toNumber())) {
+    JS_ClearPendingException(aCtx);
     SetValue(EmptyString());
     return NS_OK;
   }
diff --git a/content/html/content/src/nsHTMLLinkElement.cpp b/content/html/content/src/nsHTMLLinkElement.cpp
index 5c8133380284..da1d02de4bc9 100644
--- a/content/html/content/src/nsHTMLLinkElement.cpp
+++ b/content/html/content/src/nsHTMLLinkElement.cpp
@@ -103,6 +103,7 @@ protected:
   virtual void GetStyleSheetInfo(nsAString& aTitle,
                                  nsAString& aType,
                                  nsAString& aMedia,
+                                 bool* aIsScoped,
                                  bool* aIsAlternate);
   virtual CORSMode GetCORSMode() const;
 protected:
@@ -431,11 +432,13 @@ void
 nsHTMLLinkElement::GetStyleSheetInfo(nsAString& aTitle,
                                      nsAString& aType,
                                      nsAString& aMedia,
+                                     bool* aIsScoped,
                                      bool* aIsAlternate)
 {
   aTitle.Truncate();
   aType.Truncate();
   aMedia.Truncate();
+  *aIsScoped = false;
   *aIsAlternate = false;
 
   nsAutoString rel;
diff --git a/content/html/content/src/nsHTMLMediaElement.cpp b/content/html/content/src/nsHTMLMediaElement.cpp
index fd2af3300469..4ccd10a58a82 100644
--- a/content/html/content/src/nsHTMLMediaElement.cpp
+++ b/content/html/content/src/nsHTMLMediaElement.cpp
@@ -3570,9 +3570,10 @@ void nsHTMLMediaElement::UpdateAudioChannelPlayingState()
   // The nsHTMLMediaElement is registered to the AudioChannelService only on B2G.
 #ifdef MOZ_B2G
   bool playingThroughTheAudioChannel =
-     (mReadyState >= nsIDOMHTMLMediaElement::HAVE_CURRENT_DATA &&
-      !mPaused &&
-      !IsPlaybackEnded());
+     (!mPaused &&
+      (HasAttr(kNameSpaceID_None, nsGkAtoms::loop) ||
+       (mReadyState >= nsIDOMHTMLMediaElement::HAVE_CURRENT_DATA &&
+        !IsPlaybackEnded())));
   if (playingThroughTheAudioChannel != mPlayingThroughTheAudioChannel) {
     mPlayingThroughTheAudioChannel = playingThroughTheAudioChannel;
 
diff --git a/content/html/content/src/nsHTMLStyleElement.cpp b/content/html/content/src/nsHTMLStyleElement.cpp
index d77ed5125218..5951c4d713fb 100644
--- a/content/html/content/src/nsHTMLStyleElement.cpp
+++ b/content/html/content/src/nsHTMLStyleElement.cpp
@@ -86,6 +86,7 @@ protected:
   void GetStyleSheetInfo(nsAString& aTitle,
                          nsAString& aType,
                          nsAString& aMedia,
+                         bool* aIsScoped,
                          bool* aIsAlternate);
   /**
    * Common method to call from the various mutation observer methods.
@@ -164,6 +165,7 @@ nsHTMLStyleElement::SetDisabled(bool aDisabled)
 }
 
 NS_IMPL_STRING_ATTR(nsHTMLStyleElement, Media, media)
+NS_IMPL_BOOL_ATTR(nsHTMLStyleElement, Scoped, scoped)
 NS_IMPL_STRING_ATTR(nsHTMLStyleElement, Type, type)
 
 void
@@ -242,11 +244,14 @@ nsHTMLStyleElement::SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
 {
   nsresult rv = nsGenericHTMLElement::SetAttr(aNameSpaceID, aName, aPrefix,
                                               aValue, aNotify);
-  if (NS_SUCCEEDED(rv) && aNameSpaceID == kNameSpaceID_None &&
-      (aName == nsGkAtoms::title ||
-       aName == nsGkAtoms::media ||
-       aName == nsGkAtoms::type)) {
-    UpdateStyleSheetInternal(nullptr, true);
+  if (NS_SUCCEEDED(rv) && aNameSpaceID == kNameSpaceID_None) {
+    if (aName == nsGkAtoms::title ||
+        aName == nsGkAtoms::media ||
+        aName == nsGkAtoms::type) {
+      UpdateStyleSheetInternal(nullptr, true);
+    } else if (aName == nsGkAtoms::scoped) {
+      UpdateStyleSheetScopedness(true);
+    }
   }
 
   return rv;
@@ -258,11 +263,14 @@ nsHTMLStyleElement::UnsetAttr(int32_t aNameSpaceID, nsIAtom* aAttribute,
 {
   nsresult rv = nsGenericHTMLElement::UnsetAttr(aNameSpaceID, aAttribute,
                                                 aNotify);
-  if (NS_SUCCEEDED(rv) && aNameSpaceID == kNameSpaceID_None &&
-      (aAttribute == nsGkAtoms::title ||
-       aAttribute == nsGkAtoms::media ||
-       aAttribute == nsGkAtoms::type)) {
-    UpdateStyleSheetInternal(nullptr, true);
+  if (NS_SUCCEEDED(rv) && aNameSpaceID == kNameSpaceID_None) {
+    if (aAttribute == nsGkAtoms::title ||
+        aAttribute == nsGkAtoms::media ||
+        aAttribute == nsGkAtoms::type) {
+      UpdateStyleSheetInternal(nullptr, true);
+    } else if (aAttribute == nsGkAtoms::scoped) {
+      UpdateStyleSheetScopedness(false);
+    }
   }
 
   return rv;
@@ -298,6 +306,7 @@ void
 nsHTMLStyleElement::GetStyleSheetInfo(nsAString& aTitle,
                                       nsAString& aType,
                                       nsAString& aMedia,
+                                      bool* aIsScoped,
                                       bool* aIsAlternate)
 {
   aTitle.Truncate();
@@ -317,6 +326,8 @@ nsHTMLStyleElement::GetStyleSheetInfo(nsAString& aTitle,
 
   GetAttr(kNameSpaceID_None, nsGkAtoms::type, aType);
 
+  *aIsScoped = HasAttr(kNameSpaceID_None, nsGkAtoms::scoped);
+
   nsAutoString mimeType;
   nsAutoString notUsed;
   nsContentUtils::SplitMimeType(aType, mimeType, notUsed);
diff --git a/content/html/content/test/Makefile.in b/content/html/content/test/Makefile.in
index 001f46739867..cdec543b08c8 100644
--- a/content/html/content/test/Makefile.in
+++ b/content/html/content/test/Makefile.in
@@ -337,6 +337,7 @@ MOCHITEST_FILES = \
 		test_formelements.html \
 		test_rowscollection.html \
 		test_mozaudiochannel.html \
+		test_style_attributes_reflection.html \
 		$(NULL)
 
 
diff --git a/content/html/content/test/forms/test_valueasdate_attribute.html b/content/html/content/test/forms/test_valueasdate_attribute.html
index 6a8fb54c1766..7fc8d09ffa33 100644
--- a/content/html/content/test/forms/test_valueasdate_attribute.html
+++ b/content/html/content/test/forms/test_valueasdate_attribute.html
@@ -176,6 +176,9 @@ function checkSet()
     // the corresponding date string is the empty string
     [ -62135596800001,   "" ],
     // Invalid dates.
+    // We set the value to something different than the empty string because
+    // NaN should set the value to the empty string.
+    [ 86400000,          "1970-01-02" ],
     [ NaN,               "" ],
   ];
 
@@ -186,9 +189,61 @@ function checkSet()
                                 + data[1]);
   }
 
+  element.value = "test";
   element.valueAsDate = null;
   is(element.value, "", "valueAsDate should set the value to the empty string");
 
+  element.value = "test";
+  element.valueAsDate = undefined;
+  is(element.value, "", "valueAsDate should set the value to the empty string");
+
+  var illegalValues = [
+    "foobar", 42, {}, function() { return 42; }, function() { return Date(); }
+  ];
+
+  for (value of illegalValues) {
+    try {
+      var caught = false;
+      element.valueAsDate = value;
+    } catch(e) {
+      caught = true;
+    }
+    ok(caught, "Assigning " + value + " to .valueAsDate should throw");
+  }
+}
+
+function checkWithBustedPrototype()
+{
+  var element = document.createElement('input');
+  element.type = 'date';
+
+  var witnessDate = new Date();
+
+  Date.prototype.getUTCFullYear = function() { return {}; };
+  Date.prototype.getUTCMonth = function() { return {}; };
+  Date.prototype.getUTCDate = function() { return {}; };
+  Date.prototype.getTime = function() { return {}; };
+  Date.prototype.setUTCFullYear = function(y,m,d) { };
+
+  element.valueAsDate = new Date();
+
+  todo_isnot(element.valueAsDate, null, ".valueAsDate should not return null");
+  // TODO: check the Date object value (UTCFullYear, UTCMonth and UTCDate)
+  // when .valueAsDate will stop returning null.
+
+  // Same test as above but using NaN instead of {}.
+
+  Date.prototype.getUTCFullYear = function() { return NaN; };
+  Date.prototype.getUTCMonth = function() { return NaN; };
+  Date.prototype.getUTCDate = function() { return NaN; };
+  Date.prototype.getTime = function() { return NaN; };
+  Date.prototype.setUTCFullYear = function(y,m,d) { };
+
+  element.valueAsDate = new Date();
+
+  todo_isnot(element.valueAsDate, null, ".valueAsDate should not return null");
+  // TODO: check the Date object value (UTCFullYear, UTCMonth and UTCDate)
+  // when .valueAsDate will stop returning null.
 }
 
 SimpleTest.waitForExplicitFinish();
@@ -196,6 +251,7 @@ SpecialPowers.pushPrefEnv({'set': [["dom.experimental_forms", true]]}, function(
 checkAvailability();
 checkGet();
 checkSet();
+checkWithBustedPrototype();
 
 SimpleTest.finish();
 });
diff --git a/content/html/content/test/reflect.js b/content/html/content/test/reflect.js
index 0d02013bfb34..d8920417117b 100644
--- a/content/html/content/test/reflect.js
+++ b/content/html/content/test/reflect.js
@@ -62,6 +62,7 @@ function reflectString(aParameters)
     link: [ "crossOrigin" ],
     source: [ "media" ],
     textarea: [ "name", "placeholder" ],
+    style: [ "media", "type" ]
   };
   if (!(element.localName in todoAttrs) || todoAttrs[element.localName].indexOf(idlAttr) == -1) {
     is(element.getAttribute(contentAttr), "null",
diff --git a/content/html/content/test/test_style_attributes_reflection.html b/content/html/content/test/test_style_attributes_reflection.html
new file mode 100644
index 000000000000..c97bc8767625
--- /dev/null
+++ b/content/html/content/test/test_style_attributes_reflection.html
@@ -0,0 +1,41 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>Test for HTMLStyleElement attributes reflection</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <script type="application/javascript" src="reflect.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+/** Test for HTMLStyleElement attributes reflection **/
+
+var e = document.createElement("style");
+
+// .media
+reflectString({
+  element: e,
+  attribute: "media"
+});
+
+// .type
+reflectString({
+  element: e,
+  attribute: "type"
+});
+
+// .scoped
+reflectBoolean({
+  element: e,
+  attribute: "scoped"
+});
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/content/media/MediaDecoder.cpp b/content/media/MediaDecoder.cpp
index 8a470daf07ea..d8039c63a29d 100644
--- a/content/media/MediaDecoder.cpp
+++ b/content/media/MediaDecoder.cpp
@@ -821,8 +821,8 @@ void MediaDecoder::PlaybackEnded()
   PlaybackPositionChanged();
   ChangeState(PLAY_STATE_ENDED);
 
+  UpdateReadyStateForData();
   if (mOwner)  {
-    UpdateReadyStateForData();
     mOwner->PlaybackEnded();
   }
 
diff --git a/content/media/MediaResource.cpp b/content/media/MediaResource.cpp
index 930b2f8eb8a1..d1e51a38e119 100644
--- a/content/media/MediaResource.cpp
+++ b/content/media/MediaResource.cpp
@@ -1293,25 +1293,20 @@ public:
   }
   virtual int64_t GetLength() {
     MutexAutoLock lock(mLock);
-    if (mInput) {
-      EnsureSizeInitialized();
-    }
+
+    EnsureSizeInitialized();
     return mSizeInitialized ? mSize : 0;
   }
   virtual int64_t GetNextCachedData(int64_t aOffset)
   {
     MutexAutoLock lock(mLock);
-    if (!mInput) {
-      return -1;
-    }
+
     EnsureSizeInitialized();
     return (aOffset < mSize) ? aOffset : -1;
   }
   virtual int64_t GetCachedDataEnd(int64_t aOffset) {
     MutexAutoLock lock(mLock);
-    if (!mInput) {
-      return aOffset;
-    }
+
     EnsureSizeInitialized();
     return NS_MAX(aOffset, mSize);
   }
@@ -1348,9 +1343,7 @@ private:
   nsCOMPtr<nsISeekableStream> mSeekable;
 
   // Input stream for the media data. This can be used from any
-  // thread. This is annulled when the decoder is being shutdown.
-  // The decoder can be shut down while we're calculating buffered
-  // ranges or seeking, so this must be null-checked before it's used.
+  // thread.
   nsCOMPtr<nsIInputStream>  mInput;
 
   // Whether we've attempted to initialize mSize. Note that mSize can be -1
@@ -1402,9 +1395,7 @@ void FileMediaResource::EnsureSizeInitialized()
 nsresult FileMediaResource::GetCachedRanges(nsTArray<MediaByteRange>& aRanges)
 {
   MutexAutoLock lock(mLock);
-  if (!mInput) {
-    return NS_ERROR_FAILURE;
-  }
+
   EnsureSizeInitialized();
   if (mSize == -1) {
     return NS_ERROR_FAILURE;
@@ -1470,12 +1461,11 @@ nsresult FileMediaResource::Close()
 {
   NS_ASSERTION(NS_IsMainThread(), "Only call on main thread");
 
-  MutexAutoLock lock(mLock);
+  // Since mChennel is only accessed by main thread, there is no necessary to
+  // take the lock.
   if (mChannel) {
     mChannel->Cancel(NS_ERROR_PARSED_DATA_CACHED);
     mChannel = nullptr;
-    mInput = nullptr;
-    mSeekable = nullptr;
   }
 
   return NS_OK;
@@ -1527,8 +1517,7 @@ MediaResource* FileMediaResource::CloneData(MediaDecoder* aDecoder)
 nsresult FileMediaResource::ReadFromCache(char* aBuffer, int64_t aOffset, uint32_t aCount)
 {
   MutexAutoLock lock(mLock);
-  if (!mInput || !mSeekable)
-    return NS_ERROR_FAILURE;
+
   EnsureSizeInitialized();
   int64_t offset = 0;
   nsresult res = mSeekable->Tell(&offset);
@@ -1557,8 +1546,7 @@ nsresult FileMediaResource::ReadFromCache(char* aBuffer, int64_t aOffset, uint32
 nsresult FileMediaResource::Read(char* aBuffer, uint32_t aCount, uint32_t* aBytes)
 {
   MutexAutoLock lock(mLock);
-  if (!mInput)
-    return NS_ERROR_FAILURE;
+
   EnsureSizeInitialized();
   return mInput->Read(aBuffer, aCount, aBytes);
 }
diff --git a/content/media/omx/OmxDecoder.cpp b/content/media/omx/OmxDecoder.cpp
index ea33c6dad7a1..4e28f0a495f1 100644
--- a/content/media/omx/OmxDecoder.cpp
+++ b/content/media/omx/OmxDecoder.cpp
@@ -573,10 +573,6 @@ bool OmxDecoder::ReadAudio(AudioFrame *aFrame, int64_t aSeekTimeUs)
 {
   status_t err;
 
-  if (!mAudioBuffer) {
-    return false;
-  }
-
   if (mAudioMetadataRead && aSeekTimeUs == -1) {
     // Use the data read into the buffer during metadata time
     err = OK;
@@ -595,7 +591,7 @@ bool OmxDecoder::ReadAudio(AudioFrame *aFrame, int64_t aSeekTimeUs)
 
   aSeekTimeUs = -1;
 
-  if (err == OK && mAudioBuffer->range_length() != 0) {
+  if (err == OK && mAudioBuffer && mAudioBuffer->range_length() != 0) {
     int64_t timeUs;
     if (!mAudioBuffer->meta_data()->findInt64(kKeyTime, &timeUs))
       return false;
diff --git a/content/svg/content/src/Makefile.in b/content/svg/content/src/Makefile.in
index 138d4603e35d..da1216b60725 100644
--- a/content/svg/content/src/Makefile.in
+++ b/content/svg/content/src/Makefile.in
@@ -68,7 +68,6 @@ CPPSRCS		= \
 		nsSVGUnknownElement.cpp \
 		nsSVGUseElement.cpp \
 		nsSVGViewBox.cpp \
-		nsSVGViewElement.cpp \
 		SVGAltGlyphElement.cpp \
 		SVGAngle.cpp \
 		SVGAnimatedAngle.cpp \
@@ -137,6 +136,7 @@ CPPSRCS		= \
 		SVGTransformListSMILType.cpp \
 		SVGTSpanElement.cpp \
 		SVGViewBoxSMILType.cpp \
+		SVGViewElement.cpp \
 		$(NULL)
 
 include $(topsrcdir)/config/config.mk
@@ -188,6 +188,7 @@ EXPORTS_mozilla/dom = \
 	SVGTitleElement.h \
 	SVGTransformableElement.h \
 	SVGTSpanElement.h \
+	SVGViewElement.h \
 	$(NULL)
 
 include $(topsrcdir)/config/rules.mk
diff --git a/content/svg/content/src/SVGFragmentIdentifier.cpp b/content/svg/content/src/SVGFragmentIdentifier.cpp
index 3114567077d6..3e856735bfbd 100644
--- a/content/svg/content/src/SVGFragmentIdentifier.cpp
+++ b/content/svg/content/src/SVGFragmentIdentifier.cpp
@@ -6,7 +6,7 @@
 #include "SVGFragmentIdentifier.h"
 #include "nsIDOMSVGDocument.h"
 #include "nsSVGSVGElement.h"
-#include "nsSVGViewElement.h"
+#include "mozilla/dom/SVGViewElement.h"
 #include "SVGAnimatedTransformList.h"
 
 using namespace mozilla;
@@ -27,12 +27,12 @@ IgnoreWhitespace(PRUnichar aChar)
   return false;
 }
 
-static nsSVGViewElement*
+static dom::SVGViewElement*
 GetViewElement(nsIDocument *aDocument, const nsAString &aId)
 {
   dom::Element* element = aDocument->GetElementById(aId);
   return (element && element->IsSVG(nsGkAtoms::view)) ?
-            static_cast<nsSVGViewElement*>(element) : nullptr;
+            static_cast<dom::SVGViewElement*>(element) : nullptr;
 }
 
 void 
@@ -236,7 +236,7 @@ SVGFragmentIdentifier::ProcessFragmentIdentifier(nsIDocument *aDocument,
     SaveOldZoomAndPan(rootElement);
   }
 
-  const nsSVGViewElement *viewElement = GetViewElement(aDocument, aAnchorName);
+  const dom::SVGViewElement *viewElement = GetViewElement(aDocument, aAnchorName);
 
   if (viewElement) {
     if (!rootElement->mCurrentViewID) {
diff --git a/content/svg/content/src/SVGStyleElement.cpp b/content/svg/content/src/SVGStyleElement.cpp
index bef78f677b1b..962ab403222d 100644
--- a/content/svg/content/src/SVGStyleElement.cpp
+++ b/content/svg/content/src/SVGStyleElement.cpp
@@ -3,6 +3,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "mozilla/dom/Element.h"
 #include "mozilla/dom/SVGStyleElement.h"
 #include "nsContentUtils.h"
 #include "nsStubMutationObserver.h"
@@ -98,12 +99,14 @@ SVGStyleElement::SetAttr(int32_t aNameSpaceID, nsIAtom* aName,
 {
   nsresult rv = SVGStyleElementBase::SetAttr(aNameSpaceID, aName, aPrefix,
                                              aValue, aNotify);
-  if (NS_SUCCEEDED(rv)) {
-    UpdateStyleSheetInternal(nullptr,
-                             aNameSpaceID == kNameSpaceID_None &&
-                             (aName == nsGkAtoms::title ||
-                              aName == nsGkAtoms::media ||
-                              aName == nsGkAtoms::type));
+  if (NS_SUCCEEDED(rv) && aNameSpaceID == kNameSpaceID_None) {
+    if (aName == nsGkAtoms::title ||
+        aName == nsGkAtoms::media ||
+        aName == nsGkAtoms::type) {
+      UpdateStyleSheetInternal(nullptr, true);
+    } else if (aName == nsGkAtoms::scoped) {
+      UpdateStyleSheetScopedness(true);
+    }
   }
 
   return rv;
@@ -115,12 +118,14 @@ SVGStyleElement::UnsetAttr(int32_t aNameSpaceID, nsIAtom* aAttribute,
 {
   nsresult rv = SVGStyleElementBase::UnsetAttr(aNameSpaceID, aAttribute,
                                                aNotify);
-  if (NS_SUCCEEDED(rv)) {
-    UpdateStyleSheetInternal(nullptr,
-                             aNameSpaceID == kNameSpaceID_None &&
-                             (aAttribute == nsGkAtoms::title ||
-                              aAttribute == nsGkAtoms::media ||
-                              aAttribute == nsGkAtoms::type));
+  if (NS_SUCCEEDED(rv) && aNameSpaceID == kNameSpaceID_None) {
+    if (aAttribute == nsGkAtoms::title ||
+        aAttribute == nsGkAtoms::media ||
+        aAttribute == nsGkAtoms::type) {
+      UpdateStyleSheetInternal(nullptr, true);
+    } else if (aAttribute == nsGkAtoms::scoped) {
+      UpdateStyleSheetScopedness(false);
+    }
   }
 
   return rv;
@@ -209,53 +214,39 @@ SVGStyleElement::SetXmlspace(const nsAString & aXmlspace, ErrorResult& rv)
   rv = SetAttr(kNameSpaceID_XML, nsGkAtoms::space, aXmlspace, true);
 }
 
-/* attribute DOMString type; */
-NS_IMETHODIMP SVGStyleElement::GetType(nsAString & aType)
-{
-  GetAttr(kNameSpaceID_None, nsGkAtoms::type, aType);
-
-  return NS_OK;
-}
-NS_IMETHODIMP SVGStyleElement::SetType(const nsAString & aType)
-{
-  return SetAttr(kNameSpaceID_None, nsGkAtoms::type, aType, true);
-}
-void
-SVGStyleElement::SetType(const nsAString & aType, ErrorResult& rv)
-{
-  rv = SetAttr(kNameSpaceID_None, nsGkAtoms::type, aType, true);
-}
-
 /* attribute DOMString media; */
-NS_IMETHODIMP SVGStyleElement::GetMedia(nsAString & aMedia)
-{
-  GetAttr(kNameSpaceID_None, nsGkAtoms::media, aMedia);
-
-  return NS_OK;
-}
-NS_IMETHODIMP SVGStyleElement::SetMedia(const nsAString & aMedia)
-{
-  return SetAttr(kNameSpaceID_None, nsGkAtoms::media, aMedia, true);
-}
+NS_IMPL_STRING_ATTR(SVGStyleElement, Media, media)
 void
-SVGStyleElement::SetMedia(const nsAString & aMedia, ErrorResult& rv)
+SVGStyleElement::SetMedia(const nsAString& aMedia, ErrorResult& rv)
 {
   rv = SetAttr(kNameSpaceID_None, nsGkAtoms::media, aMedia, true);
 }
 
-/* attribute DOMString title; */
-NS_IMETHODIMP SVGStyleElement::GetTitle(nsAString & aTitle)
+/* attribute boolean scoped; */
+NS_IMPL_BOOL_ATTR(SVGStyleElement, Scoped, scoped)
+bool
+SVGStyleElement::Scoped() const
 {
-  GetAttr(kNameSpaceID_None, nsGkAtoms::title, aTitle);
-
-  return NS_OK;
-}
-NS_IMETHODIMP SVGStyleElement::SetTitle(const nsAString & aTitle)
-{
-  return SetAttr(kNameSpaceID_None, nsGkAtoms::title, aTitle, true);
+  return GetBoolAttr(nsGkAtoms::scoped);
 }
 void
-SVGStyleElement::SetTitle(const nsAString & aTitle, ErrorResult& rv)
+SVGStyleElement::SetScoped(bool aScoped, ErrorResult& rv)
+{
+  rv = SetBoolAttr(nsGkAtoms::scoped, aScoped);
+}
+
+/* attribute DOMString type; */
+NS_IMPL_STRING_ATTR(SVGStyleElement, Type, type)
+void
+SVGStyleElement::SetType(const nsAString& aType, ErrorResult& rv)
+{
+  rv = SetAttr(kNameSpaceID_None, nsGkAtoms::type, aType, true);
+}
+
+/* attribute DOMString title; */
+NS_IMPL_STRING_ATTR(SVGStyleElement, Title, title)
+void
+SVGStyleElement::SetTitle(const nsAString& aTitle, ErrorResult& rv)
 {
   rv = SetAttr(kNameSpaceID_None, nsGkAtoms::title, aTitle, true);
 }
@@ -274,6 +265,7 @@ void
 SVGStyleElement::GetStyleSheetInfo(nsAString& aTitle,
                                    nsAString& aType,
                                    nsAString& aMedia,
+                                   bool* aIsScoped,
                                    bool* aIsAlternate)
 {
   *aIsAlternate = false;
@@ -293,6 +285,8 @@ SVGStyleElement::GetStyleSheetInfo(nsAString& aTitle,
     aType.AssignLiteral("text/css");
   }
 
+  *aIsScoped = HasAttr(kNameSpaceID_None, nsGkAtoms::scoped);
+
   return;
 }
 
diff --git a/content/svg/content/src/SVGStyleElement.h b/content/svg/content/src/SVGStyleElement.h
index c2a3d3f4b67a..d07729a062ca 100644
--- a/content/svg/content/src/SVGStyleElement.h
+++ b/content/svg/content/src/SVGStyleElement.h
@@ -81,6 +81,8 @@ public:
   void SetType(const nsAString & aType, ErrorResult& rv);
   void SetMedia(const nsAString & aMedia, ErrorResult& rv);
   void SetTitle(const nsAString & aTitle, ErrorResult& rv);
+  bool Scoped() const;
+  void SetScoped(bool aScoped, ErrorResult& rv);
 
 protected:
   // Dummy init method to make the NS_IMPL_NS_NEW_SVG_ELEMENT and
@@ -97,6 +99,7 @@ protected:
   void GetStyleSheetInfo(nsAString& aTitle,
                          nsAString& aType,
                          nsAString& aMedia,
+                         bool* aIsScoped,
                          bool* aIsAlternate);
   virtual CORSMode GetCORSMode() const;
 
diff --git a/content/svg/content/src/nsSVGViewElement.cpp b/content/svg/content/src/SVGViewElement.cpp
similarity index 52%
rename from content/svg/content/src/nsSVGViewElement.cpp
rename to content/svg/content/src/SVGViewElement.cpp
index 739f7811cd1e..98a3df12ba3f 100644
--- a/content/svg/content/src/nsSVGViewElement.cpp
+++ b/content/svg/content/src/SVGViewElement.cpp
@@ -3,24 +3,35 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "nsSVGViewElement.h"
+#include "mozilla/dom/SVGViewElement.h"
+#include "mozilla/dom/SVGViewElementBinding.h"
 #include "DOMSVGStringList.h"
 
-using namespace mozilla;
-using namespace mozilla::dom;
+DOMCI_NODE_DATA(SVGViewElement, mozilla::dom::SVGViewElement)
 
-nsSVGElement::StringListInfo nsSVGViewElement::sStringListInfo[1] =
+NS_IMPL_NS_NEW_NAMESPACED_SVG_ELEMENT(View)
+
+namespace mozilla {
+namespace dom {
+
+JSObject*
+SVGViewElement::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+{
+  return SVGViewElementBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+}
+
+nsSVGElement::StringListInfo SVGViewElement::sStringListInfo[1] =
 {
   { &nsGkAtoms::viewTarget }
 };
 
-nsSVGEnumMapping nsSVGViewElement::sZoomAndPanMap[] = {
+nsSVGEnumMapping SVGViewElement::sZoomAndPanMap[] = {
   {&nsGkAtoms::disable, nsIDOMSVGZoomAndPan::SVG_ZOOMANDPAN_DISABLE},
   {&nsGkAtoms::magnify, nsIDOMSVGZoomAndPan::SVG_ZOOMANDPAN_MAGNIFY},
   {nullptr, 0}
 };
 
-nsSVGElement::EnumInfo nsSVGViewElement::sEnumInfo[1] =
+nsSVGElement::EnumInfo SVGViewElement::sEnumInfo[1] =
 {
   { &nsGkAtoms::zoomAndPan,
     sZoomAndPanMap,
@@ -28,58 +39,62 @@ nsSVGElement::EnumInfo nsSVGViewElement::sEnumInfo[1] =
   }
 };
 
-NS_IMPL_NS_NEW_SVG_ELEMENT(View)
-
 //----------------------------------------------------------------------
 // nsISupports methods
 
-NS_IMPL_ADDREF_INHERITED(nsSVGViewElement,nsSVGViewElementBase)
-NS_IMPL_RELEASE_INHERITED(nsSVGViewElement,nsSVGViewElementBase)
+NS_IMPL_ADDREF_INHERITED(SVGViewElement,SVGViewElementBase)
+NS_IMPL_RELEASE_INHERITED(SVGViewElement,SVGViewElementBase)
 
-DOMCI_NODE_DATA(SVGViewElement, nsSVGViewElement)
-
-NS_INTERFACE_TABLE_HEAD(nsSVGViewElement)
-  NS_NODE_INTERFACE_TABLE6(nsSVGViewElement, nsIDOMNode, nsIDOMElement,
+NS_INTERFACE_TABLE_HEAD(SVGViewElement)
+  NS_NODE_INTERFACE_TABLE6(SVGViewElement, nsIDOMNode, nsIDOMElement,
                            nsIDOMSVGElement, nsIDOMSVGViewElement,
                            nsIDOMSVGFitToViewBox,
                            nsIDOMSVGZoomAndPan)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(SVGViewElement)
-NS_INTERFACE_MAP_END_INHERITING(nsSVGViewElementBase)
+NS_INTERFACE_MAP_END_INHERITING(SVGViewElementBase)
 
 //----------------------------------------------------------------------
 // Implementation
 
-nsSVGViewElement::nsSVGViewElement(already_AddRefed<nsINodeInfo> aNodeInfo)
-  : nsSVGViewElementBase(aNodeInfo)
+SVGViewElement::SVGViewElement(already_AddRefed<nsINodeInfo> aNodeInfo)
+  : SVGViewElementBase(aNodeInfo)
 {
 }
 
 //----------------------------------------------------------------------
 // nsIDOMNode methods
 
-NS_IMPL_ELEMENT_CLONE_WITH_INIT(nsSVGViewElement)
+NS_IMPL_ELEMENT_CLONE_WITH_INIT(SVGViewElement)
 
 //----------------------------------------------------------------------
 // nsIDOMSVGZoomAndPan methods
 
 /* attribute unsigned short zoomAndPan; */
 NS_IMETHODIMP
-nsSVGViewElement::GetZoomAndPan(uint16_t *aZoomAndPan)
+SVGViewElement::GetZoomAndPan(uint16_t *aZoomAndPan)
 {
-  *aZoomAndPan = mEnumAttributes[ZOOMANDPAN].GetAnimValue();
+  *aZoomAndPan = ZoomAndPan();
   return NS_OK;
 }
 
 NS_IMETHODIMP
-nsSVGViewElement::SetZoomAndPan(uint16_t aZoomAndPan)
+SVGViewElement::SetZoomAndPan(uint16_t aZoomAndPan)
+{
+  ErrorResult rv;
+  SetZoomAndPan(aZoomAndPan, rv);
+  return rv.ErrorCode();
+}
+
+void
+SVGViewElement::SetZoomAndPan(uint16_t aZoomAndPan, ErrorResult& rv)
 {
   if (aZoomAndPan == nsIDOMSVGZoomAndPan::SVG_ZOOMANDPAN_DISABLE ||
       aZoomAndPan == nsIDOMSVGZoomAndPan::SVG_ZOOMANDPAN_MAGNIFY) {
     mEnumAttributes[ZOOMANDPAN].SetBaseValue(aZoomAndPan, this);
-    return NS_OK;
+    return;
   }
 
-  return NS_ERROR_RANGE_ERR;
+  rv.Throw(NS_ERROR_RANGE_ERR);
 }
 
 //----------------------------------------------------------------------
@@ -87,58 +102,82 @@ nsSVGViewElement::SetZoomAndPan(uint16_t aZoomAndPan)
 
 /* readonly attribute nsIDOMSVGAnimatedRect viewBox; */
 NS_IMETHODIMP
-nsSVGViewElement::GetViewBox(nsIDOMSVGAnimatedRect * *aViewBox)
+SVGViewElement::GetViewBox(nsIDOMSVGAnimatedRect * *aViewBox)
 {
-  return mViewBox.ToDOMAnimatedRect(aViewBox, this);
+  *aViewBox = ViewBox().get();
+  return NS_OK;
+}
+
+already_AddRefed<nsIDOMSVGAnimatedRect>
+SVGViewElement::ViewBox()
+{
+  nsCOMPtr<nsIDOMSVGAnimatedRect> box;
+  mViewBox.ToDOMAnimatedRect(getter_AddRefs(box), this);
+  return box.forget();
 }
 
 /* readonly attribute SVGPreserveAspectRatio preserveAspectRatio; */
 NS_IMETHODIMP
-nsSVGViewElement::GetPreserveAspectRatio(nsISupports
-                                         **aPreserveAspectRatio)
+SVGViewElement::GetPreserveAspectRatio(nsISupports
+                                       **aPreserveAspectRatio)
+{
+  *aPreserveAspectRatio = PreserveAspectRatio().get();
+  return NS_OK;
+}
+
+already_AddRefed<DOMSVGAnimatedPreserveAspectRatio>
+SVGViewElement::PreserveAspectRatio()
 {
   nsRefPtr<DOMSVGAnimatedPreserveAspectRatio> ratio;
   mPreserveAspectRatio.ToDOMAnimatedPreserveAspectRatio(getter_AddRefs(ratio), this);
-  ratio.forget(aPreserveAspectRatio);
-  return NS_OK;
+  return ratio.forget();
 }
 
 //----------------------------------------------------------------------
 // nsIDOMSVGViewElement methods
 
 /* readonly attribute nsIDOMSVGStringList viewTarget; */
-NS_IMETHODIMP nsSVGViewElement::GetViewTarget(nsIDOMSVGStringList * *aViewTarget)
+NS_IMETHODIMP SVGViewElement::GetViewTarget(nsIDOMSVGStringList * *aViewTarget)
 {
-  *aViewTarget = DOMSVGStringList::GetDOMWrapper(
-                   &mStringListAttributes[VIEW_TARGET], this, false, VIEW_TARGET).get();
+  *aViewTarget = ViewTarget().get();
   return NS_OK;
 }
 
+already_AddRefed<nsIDOMSVGStringList>
+SVGViewElement::ViewTarget()
+{
+  return DOMSVGStringList::GetDOMWrapper(
+           &mStringListAttributes[VIEW_TARGET], this, false, VIEW_TARGET);
+}
+
 //----------------------------------------------------------------------
 // nsSVGElement methods
 
 nsSVGElement::EnumAttributesInfo
-nsSVGViewElement::GetEnumInfo()
+SVGViewElement::GetEnumInfo()
 {
   return EnumAttributesInfo(mEnumAttributes, sEnumInfo,
                             ArrayLength(sEnumInfo));
 }
 
 nsSVGViewBox *
-nsSVGViewElement::GetViewBox()
+SVGViewElement::GetViewBox()
 {
   return &mViewBox;
 }
 
 SVGAnimatedPreserveAspectRatio *
-nsSVGViewElement::GetPreserveAspectRatio()
+SVGViewElement::GetPreserveAspectRatio()
 {
   return &mPreserveAspectRatio;
 }
 
 nsSVGElement::StringListAttributesInfo
-nsSVGViewElement::GetStringListInfo()
+SVGViewElement::GetStringListInfo()
 {
   return StringListAttributesInfo(mStringListAttributes, sStringListInfo,
                                   ArrayLength(sStringListInfo));
 }
+
+} // namespace dom
+} // namespace mozilla
diff --git a/content/svg/content/src/nsSVGViewElement.h b/content/svg/content/src/SVGViewElement.h
similarity index 54%
rename from content/svg/content/src/nsSVGViewElement.h
rename to content/svg/content/src/SVGViewElement.h
index 41f0598115a0..9bf89061bdc0 100644
--- a/content/svg/content/src/nsSVGViewElement.h
+++ b/content/svg/content/src/SVGViewElement.h
@@ -3,8 +3,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef __NS_SVGVIEWELEMENT_H__
-#define __NS_SVGVIEWELEMENT_H__
+#ifndef mozilla_dom_SVGViewElement_h
+#define mozilla_dom_SVGViewElement_h
 
 #include "nsIDOMSVGViewElement.h"
 #include "nsIDOMSVGFitToViewBox.h"
@@ -15,27 +15,36 @@
 #include "SVGAnimatedPreserveAspectRatio.h"
 #include "SVGStringList.h"
 
+typedef nsSVGElement SVGViewElementBase;
+
+class nsSVGSVGElement;
+class nsSVGOuterSVGFrame;
+
+nsresult NS_NewSVGViewElement(nsIContent **aResult,
+                              already_AddRefed<nsINodeInfo> aNodeInfo);
+
 namespace mozilla {
-  class SVGFragmentIdentifier;
-}
+class SVGFragmentIdentifier;
 
-typedef nsSVGElement nsSVGViewElementBase;
+namespace dom {
 
-class nsSVGViewElement : public nsSVGViewElementBase,
-                         public nsIDOMSVGViewElement,
-                         public nsIDOMSVGFitToViewBox,
-                         public nsIDOMSVGZoomAndPan
+class SVGViewElement : public SVGViewElementBase,
+                       public nsIDOMSVGViewElement,
+                       public nsIDOMSVGFitToViewBox,
+                       public nsIDOMSVGZoomAndPan
 {
+protected:
   friend class mozilla::SVGFragmentIdentifier;
-  friend class nsSVGSVGElement;
-  friend class nsSVGOuterSVGFrame;
-  friend nsresult NS_NewSVGViewElement(nsIContent **aResult,
-                                       already_AddRefed<nsINodeInfo> aNodeInfo);
-  nsSVGViewElement(already_AddRefed<nsINodeInfo> aNodeInfo);
-  
+  friend class ::nsSVGSVGElement;
+  friend class ::nsSVGOuterSVGFrame;
+  SVGViewElement(already_AddRefed<nsINodeInfo> aNodeInfo);
+  friend nsresult (::NS_NewSVGViewElement(nsIContent **aResult,
+                                          already_AddRefed<nsINodeInfo> aNodeInfo));
+  virtual JSObject* WrapNode(JSContext *cx, JSObject *scope, bool *triedToWrap) MOZ_OVERRIDE;
+
 public:
   // interfaces:
-  
+
   NS_DECL_ISUPPORTS_INHERITED
   NS_DECL_NSIDOMSVGVIEWELEMENT
   NS_DECL_NSIDOMSVGFITTOVIEWBOX
@@ -45,13 +54,21 @@ public:
   // forward here :-(
   NS_FORWARD_NSIDOMNODE_TO_NSINODE
   NS_FORWARD_NSIDOMELEMENT_TO_GENERIC
-  NS_FORWARD_NSIDOMSVGELEMENT(nsSVGViewElementBase::)
+  NS_FORWARD_NSIDOMSVGELEMENT(SVGViewElementBase::)
 
   virtual nsresult Clone(nsINodeInfo *aNodeInfo, nsINode **aResult) const;
 
   virtual nsXPCClassInfo* GetClassInfo();
 
   virtual nsIDOMNode* AsDOMNode() { return this; }
+
+  // WebIDL
+  uint16_t ZoomAndPan() { return mEnumAttributes[ZOOMANDPAN].GetAnimValue(); }
+  void SetZoomAndPan(uint16_t aZoomAndPan, ErrorResult& rv);
+  already_AddRefed<nsIDOMSVGAnimatedRect> ViewBox();
+  already_AddRefed<DOMSVGAnimatedPreserveAspectRatio> PreserveAspectRatio();
+  already_AddRefed<nsIDOMSVGStringList> ViewTarget();
+
 private:
 
   // nsSVGElement overrides
@@ -76,4 +93,7 @@ private:
   static StringListInfo sStringListInfo[1];
 };
 
-#endif
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_SVGViewElement_h
diff --git a/content/svg/content/src/nsDOMSVGZoomEvent.cpp b/content/svg/content/src/nsDOMSVGZoomEvent.cpp
index ae937c7d4e7f..cdd7ecb52e32 100644
--- a/content/svg/content/src/nsDOMSVGZoomEvent.cpp
+++ b/content/svg/content/src/nsDOMSVGZoomEvent.cpp
@@ -7,7 +7,6 @@
 #include "nsSVGRect.h"
 #include "DOMSVGPoint.h"
 #include "nsSVGSVGElement.h"
-#include "nsIDOMSVGSVGElement.h"
 #include "nsIPresShell.h"
 #include "nsIDocument.h"
 #include "mozilla/dom/Element.h"
@@ -44,15 +43,14 @@ nsDOMSVGZoomEvent::nsDOMSVGZoomEvent(nsPresContext* aPresContext,
     if (doc) {
       Element *rootElement = doc->GetRootElement();
       if (rootElement) {
-        // If the root element isn't an SVG 'svg' element this QI will fail
+        // If the root element isn't an SVG 'svg' element
         // (e.g. if this event was created by calling createEvent on a
-        // non-SVGDocument). In these circumstances the "New" and "Previous"
+        // non-SVGDocument), then the "New" and "Previous"
         // properties will be left null which is probably what we want.
-        nsCOMPtr<nsIDOMSVGSVGElement> svgElement = do_QueryInterface(rootElement);
-        if (svgElement) {
+        if (rootElement->IsSVG(nsGkAtoms::svg)) {
           nsSVGSVGElement *SVGSVGElement =
             static_cast<nsSVGSVGElement*>(rootElement);
-  
+
           mNewScale = SVGSVGElement->GetCurrentScale();
           mPreviousScale = SVGSVGElement->GetPreviousScale();
 
diff --git a/content/svg/content/src/nsSVGGradientElement.cpp b/content/svg/content/src/nsSVGGradientElement.cpp
index 3dad01755ee2..a6d5dacb1815 100644
--- a/content/svg/content/src/nsSVGGradientElement.cpp
+++ b/content/svg/content/src/nsSVGGradientElement.cpp
@@ -150,9 +150,8 @@ NS_IMPL_RELEASE_INHERITED(nsSVGLinearGradientElement,nsSVGLinearGradientElementB
 DOMCI_NODE_DATA(SVGLinearGradientElement, nsSVGLinearGradientElement)
 
 NS_INTERFACE_TABLE_HEAD(nsSVGLinearGradientElement)
-  NS_NODE_INTERFACE_TABLE6(nsSVGLinearGradientElement, nsIDOMNode,
+  NS_NODE_INTERFACE_TABLE5(nsSVGLinearGradientElement, nsIDOMNode,
                            nsIDOMElement, nsIDOMSVGElement,
-                           nsIDOMSVGTests,
                            nsIDOMSVGGradientElement,
                            nsIDOMSVGLinearGradientElement)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(SVGLinearGradientElement)
@@ -240,9 +239,8 @@ NS_IMPL_RELEASE_INHERITED(nsSVGRadialGradientElement,nsSVGRadialGradientElementB
 DOMCI_NODE_DATA(SVGRadialGradientElement, nsSVGRadialGradientElement)
 
 NS_INTERFACE_TABLE_HEAD(nsSVGRadialGradientElement)
-  NS_NODE_INTERFACE_TABLE6(nsSVGRadialGradientElement, nsIDOMNode,
+  NS_NODE_INTERFACE_TABLE5(nsSVGRadialGradientElement, nsIDOMNode,
                            nsIDOMElement, nsIDOMSVGElement,
-                           nsIDOMSVGTests,
                            nsIDOMSVGGradientElement,
                            nsIDOMSVGRadialGradientElement)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(SVGRadialGradientElement)
diff --git a/content/svg/content/src/nsSVGGradientElement.h b/content/svg/content/src/nsSVGGradientElement.h
index d988cc37043c..fe486fa67afe 100644
--- a/content/svg/content/src/nsSVGGradientElement.h
+++ b/content/svg/content/src/nsSVGGradientElement.h
@@ -8,7 +8,6 @@
 
 #include "nsIDOMSVGURIReference.h"
 #include "nsIDOMSVGGradientElement.h"
-#include "DOMSVGTests.h"
 #include "nsIDOMSVGUnitTypes.h"
 #include "nsSVGElement.h"
 #include "nsSVGLength2.h"
@@ -21,7 +20,6 @@
 typedef nsSVGElement nsSVGGradientElementBase;
 
 class nsSVGGradientElement : public nsSVGGradientElementBase,
-                             public DOMSVGTests,
                              public nsIDOMSVGURIReference,
                              public nsIDOMSVGUnitTypes
 {
diff --git a/content/svg/content/src/nsSVGSVGElement.cpp b/content/svg/content/src/nsSVGSVGElement.cpp
index b2245b284230..d4a311048133 100644
--- a/content/svg/content/src/nsSVGSVGElement.cpp
+++ b/content/svg/content/src/nsSVGSVGElement.cpp
@@ -28,7 +28,7 @@
 #include "nsGUIEvent.h"
 #include "nsSVGSVGElement.h"
 #include "nsSVGUtils.h"
-#include "nsSVGViewElement.h"
+#include "mozilla/dom/SVGViewElement.h"
 #include "nsStyleUtil.h"
 #include "SVGContentUtils.h"
 
@@ -608,11 +608,11 @@ nsSVGSVGElement::GetPreserveAspectRatio(nsISupports
 NS_IMETHODIMP
 nsSVGSVGElement::GetZoomAndPan(uint16_t *aZoomAndPan)
 {
-  nsSVGViewElement* viewElement = GetCurrentViewElement();
+  SVGViewElement* viewElement = GetCurrentViewElement();
   if (viewElement && viewElement->mEnumAttributes[
-                       nsSVGViewElement::ZOOMANDPAN].IsExplicitlySet()) {
+                       SVGViewElement::ZOOMANDPAN].IsExplicitlySet()) {
     *aZoomAndPan = viewElement->mEnumAttributes[
-                     nsSVGViewElement::ZOOMANDPAN].GetAnimValue();
+                     SVGViewElement::ZOOMANDPAN].GetAnimValue();
   } else {
     *aZoomAndPan = mEnumAttributes[ZOOMANDPAN].GetAnimValue();
   }
@@ -974,7 +974,7 @@ nsSVGSVGElement::HasPreserveAspectRatio()
     mPreserveAspectRatio.IsAnimated();
 }
 
-nsSVGViewElement*
+SVGViewElement*
 nsSVGSVGElement::GetCurrentViewElement() const
 {
   if (mCurrentViewID) {
@@ -982,7 +982,7 @@ nsSVGSVGElement::GetCurrentViewElement() const
     if (doc) {
       Element *element = doc->GetElementById(*mCurrentViewID);
       if (element && element->IsSVG(nsGkAtoms::view)) {
-        return static_cast<nsSVGViewElement*>(element);
+        return static_cast<SVGViewElement*>(element);
       }
     }
   }
@@ -994,7 +994,7 @@ nsSVGSVGElement::GetViewBoxWithSynthesis(
   float aViewportWidth, float aViewportHeight) const
 {
   // The logic here should match HasViewBox().
-  nsSVGViewElement* viewElement = GetCurrentViewElement();
+  SVGViewElement* viewElement = GetCurrentViewElement();
   if (viewElement && viewElement->mViewBox.IsExplicitlySet()) {
     return viewElement->mViewBox.GetAnimValue();
   }
@@ -1029,7 +1029,7 @@ nsSVGSVGElement::GetPreserveAspectRatioWithOverride() const
     }
   }
 
-  nsSVGViewElement* viewElement = GetCurrentViewElement();
+  SVGViewElement* viewElement = GetCurrentViewElement();
 
   // This check is equivalent to "!HasViewBox() && ShouldSynthesizeViewBox()".
   // We're just holding onto the viewElement that HasViewBox() would look up,
@@ -1055,7 +1055,7 @@ nsSVGSVGElement::GetLength(uint8_t aCtxType)
 {
   float h, w;
 
-  nsSVGViewElement* viewElement = GetCurrentViewElement();
+  SVGViewElement* viewElement = GetCurrentViewElement();
   const nsSVGViewBoxRect* viewbox = nullptr;
 
   // The logic here should match HasViewBox().
@@ -1177,7 +1177,7 @@ nsSVGSVGElement::GetPreserveAspectRatio()
 bool
 nsSVGSVGElement::HasViewBox() const
 {
-  nsSVGViewElement* viewElement = GetCurrentViewElement();
+  SVGViewElement* viewElement = GetCurrentViewElement();
   if (viewElement && viewElement->mViewBox.IsExplicitlySet()) {
     return true;
   }
diff --git a/content/svg/content/src/nsSVGSVGElement.h b/content/svg/content/src/nsSVGSVGElement.h
index a91b72a4f3cc..e6d412deeb21 100644
--- a/content/svg/content/src/nsSVGSVGElement.h
+++ b/content/svg/content/src/nsSVGSVGElement.h
@@ -21,10 +21,13 @@
 #include "mozilla/Attributes.h"
 
 class nsSMILTimeContainer;
-class nsSVGViewElement;
 namespace mozilla {
   class DOMSVGMatrix;
   class SVGFragmentIdentifier;
+
+  namespace dom {
+    class SVGViewElement;
+  }
 }
 
 typedef mozilla::dom::SVGGraphicsElement nsSVGSVGElementBase;
@@ -261,7 +264,7 @@ private:
 
   // implementation helpers:
 
-  nsSVGViewElement* GetCurrentViewElement() const;
+  mozilla::dom::SVGViewElement* GetCurrentViewElement() const;
 
   // Methods for <image> elements to override my "PreserveAspectRatio" value.
   // These are private so that only our friends (nsSVGImageFrame in
diff --git a/content/svg/content/test/Makefile.in b/content/svg/content/test/Makefile.in
index 9dd30ad622aa..2d5784f5326f 100644
--- a/content/svg/content/test/Makefile.in
+++ b/content/svg/content/test/Makefile.in
@@ -51,6 +51,7 @@ MOCHITEST_FILES = \
 		test_pointer-events.xhtml \
 		test_pointer-events-2.xhtml \
 		test_pointer-events-3.xhtml \
+		test_pointer-events-4.xhtml \
 		test_scientific.html \
 		scientific-helper.svg \
 		test_SVGAnimatedImageSMILDisabled.html \
diff --git a/content/svg/content/test/test_pointer-events-4.xhtml b/content/svg/content/test/test_pointer-events-4.xhtml
new file mode 100644
index 000000000000..bab3baae83f0
--- /dev/null
+++ b/content/svg/content/test/test_pointer-events-4.xhtml
@@ -0,0 +1,110 @@
+<html xmlns="http://www.w3.org/1999/xhtml">
+<!--
+https://bugzilla.mozilla.org/show_bug.cgi?id=820506
+-->
+<head>
+  <title>Test pointer events with clipPath</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body onload="run()">
+<script class="testbody" type="text/javascript">
+<![CDATA[
+
+SimpleTest.waitForExplicitFinish();
+
+function run()
+{
+  var svgDoc = document.getElementById('svg');
+  var div = document.getElementById("div");
+  // Get the coords of the origin of the SVG canvas:
+  var originX = div.offsetLeft;
+  var originY = div.offsetTop;
+  var r1 = document.getElementById('r1');
+  var r2 = document.getElementById('r2');
+  var element;
+
+  // Test r1 just outsite the clip area:
+
+  element = document.elementFromPoint(originX + 19, originY + 19);
+  is(element, background, 'Should not hit top-left of r1');
+
+  element = document.elementFromPoint(originX + 101, originY + 19);
+  is(element, background, 'Should not hit top-right of r1');
+
+  element = document.elementFromPoint(originX + 101, originY + 101);
+  is(element, background, 'Should not hit bottom-right of r1');
+
+  element = document.elementFromPoint(originX + 19, originY + 101);
+  is(element, background, 'Should not hit bottom-left of r1');
+
+  // Test r1 just inside the clip area:
+
+  element = document.elementFromPoint(originX + 21, originY + 21);
+  is(element, r1, 'Should hit top-left of r1');
+
+  element = document.elementFromPoint(originX + 99, originY + 21);
+  is(element, r1, 'Should hit top-right of r1');
+
+  element = document.elementFromPoint(originX + 99, originY + 99);
+  is(element, r1, 'Should hit bottom-right of r1');
+
+  element = document.elementFromPoint(originX + 21, originY + 99);
+  is(element, r1, 'Should hit bottom-left of r1');
+
+  // Test r2 just outsite the clip area:
+
+  element = document.elementFromPoint(originX + 109, originY + 19);
+  is(element, background, 'Should not hit top-left of r2');
+
+  element = document.elementFromPoint(originX + 201, originY + 19);
+  is(element, background, 'Should not hit top-right of r2');
+
+  element = document.elementFromPoint(originX + 201, originY + 101);
+  is(element, background, 'Should not hit bottom-right of r2');
+
+  element = document.elementFromPoint(originX + 109, originY + 101);
+  is(element, background, 'Should not hit bottom-left of r2');
+
+  // Test r2 just inside the clip area:
+
+  element = document.elementFromPoint(originX + 121, originY + 21);
+  is(element, r2, 'Should hit top-left of r2');
+
+  element = document.elementFromPoint(originX + 199, originY + 21);
+  is(element, r2, 'Should hit top-right of r2');
+
+  element = document.elementFromPoint(originX + 199, originY + 99);
+  is(element, r2, 'Should hit bottom-right of r2');
+
+  element = document.elementFromPoint(originX + 121, originY + 99);
+  is(element, r2, 'Should hit bottom-left of r2');
+
+  SimpleTest.finish();
+}
+
+]]>
+</script>
+<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=500174">Mozilla Bug 500174</a>
+<p id="display"></p>
+<div id="content">
+
+  <div width="100%" height="1" id="div">
+  </div>
+  <svg xmlns="http://www.w3.org/2000/svg" width="100%" height="100%" id="svg">
+    <clipPath id="cp1" clipPathUnits="userSpaceOnUse">
+      <rect x="20" y="20" width="80" height="80"/>
+    </clipPath>
+    <clipPath id="cp2" clipPathUnits="objectBoundingBox">
+      <rect x="0.1" y="0.1" width="0.8" height="0.8"/>
+    </clipPath>
+    <rect id="background" width="100%" height="100%" fill="blue"/>
+    <rect id="r1" x="10" y="10" width="100" height="100" clip-path="url(#cp1)"/>
+    <rect id="r2" x="110" y="10" width="100" height="100" clip-path="url(#cp2)"/>
+  </svg>
+
+</div>
+<pre id="test">
+</pre>
+</body>
+</html>
diff --git a/content/xbl/src/nsXBLPrototypeResources.cpp b/content/xbl/src/nsXBLPrototypeResources.cpp
index bd18dc503c3c..51ff4235b81c 100644
--- a/content/xbl/src/nsXBLPrototypeResources.cpp
+++ b/content/xbl/src/nsXBLPrototypeResources.cpp
@@ -101,7 +101,8 @@ nsXBLPrototypeResources::FlushSkinSheets()
     mStyleSheetList.AppendElement(newSheet);
   }
   mRuleProcessor = new nsCSSRuleProcessor(mStyleSheetList, 
-                                          nsStyleSet::eDocSheet);
+                                          nsStyleSet::eDocSheet,
+                                          nullptr);
 
   return NS_OK;
 }
diff --git a/content/xbl/src/nsXBLResourceLoader.cpp b/content/xbl/src/nsXBLResourceLoader.cpp
index 38a471cad105..018ca1d191a5 100644
--- a/content/xbl/src/nsXBLResourceLoader.cpp
+++ b/content/xbl/src/nsXBLResourceLoader.cpp
@@ -167,7 +167,8 @@ nsXBLResourceLoader::StyleSheetLoaded(nsCSSStyleSheet* aSheet,
     // All stylesheets are loaded.  
     mResources->mRuleProcessor =
       new nsCSSRuleProcessor(mResources->mStyleSheetList, 
-                             nsStyleSet::eDocSheet);
+                             nsStyleSet::eDocSheet,
+                             nullptr);
 
     // XXX Check for mPendingScripts when scripts also come online.
     if (!mInLoadResourcesFunc)
diff --git a/content/xml/content/src/CDATASection.cpp b/content/xml/content/src/CDATASection.cpp
new file mode 100644
index 000000000000..95d7e12db7e6
--- /dev/null
+++ b/content/xml/content/src/CDATASection.cpp
@@ -0,0 +1,102 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "mozilla/dom/CDATASection.h"
+#include "mozilla/dom/CDATASectionBinding.h"
+
+nsresult
+NS_NewXMLCDATASection(nsIContent** aInstancePtrResult,
+                      nsNodeInfoManager *aNodeInfoManager)
+{
+  using mozilla::dom::CDATASection;
+
+  NS_PRECONDITION(aNodeInfoManager, "Missing nodeinfo manager");
+
+  *aInstancePtrResult = nullptr;
+
+  nsCOMPtr<nsINodeInfo> ni;
+  ni = aNodeInfoManager->GetNodeInfo(nsGkAtoms::cdataTagName,
+                                     nullptr, kNameSpaceID_None,
+                                     nsIDOMNode::CDATA_SECTION_NODE);
+  NS_ENSURE_TRUE(ni, NS_ERROR_OUT_OF_MEMORY);
+
+  CDATASection *instance = new CDATASection(ni.forget());
+  if (!instance) {
+    return NS_ERROR_OUT_OF_MEMORY;
+  }
+
+  NS_ADDREF(*aInstancePtrResult = instance);
+
+  return NS_OK;
+}
+
+DOMCI_NODE_DATA(CDATASection, mozilla::dom::CDATASection)
+
+namespace mozilla {
+namespace dom {
+
+CDATASection::~CDATASection()
+{
+}
+
+
+// QueryInterface implementation for CDATASection
+NS_INTERFACE_TABLE_HEAD(CDATASection)
+  NS_NODE_INTERFACE_TABLE4(CDATASection, nsIDOMNode, nsIDOMCharacterData,
+                           nsIDOMText, nsIDOMCDATASection)
+  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(CDATASection)
+NS_INTERFACE_MAP_END_INHERITING(nsGenericDOMDataNode)
+
+NS_IMPL_ADDREF_INHERITED(CDATASection, nsGenericDOMDataNode)
+NS_IMPL_RELEASE_INHERITED(CDATASection, nsGenericDOMDataNode)
+
+JSObject*
+CDATASection::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+{
+  return CDATASectionBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+}
+
+bool
+CDATASection::IsNodeOfType(uint32_t aFlags) const
+{
+  return !(aFlags & ~(eCONTENT | eTEXT | eDATA_NODE));
+}
+
+nsGenericDOMDataNode*
+CDATASection::CloneDataNode(nsINodeInfo *aNodeInfo, bool aCloneText) const
+{
+  nsCOMPtr<nsINodeInfo> ni = aNodeInfo;
+  CDATASection *it = new CDATASection(ni.forget());
+  if (it && aCloneText) {
+    it->mText = mText;
+  }
+
+  return it;
+}
+
+#ifdef DEBUG
+void
+CDATASection::List(FILE* out, int32_t aIndent) const
+{
+  int32_t index;
+  for (index = aIndent; --index >= 0; ) fputs("  ", out);
+
+  fprintf(out, "CDATASection refcount=%d<", mRefCnt.get());
+
+  nsAutoString tmp;
+  ToCString(tmp, 0, mText.GetLength());
+  fputs(NS_LossyConvertUTF16toASCII(tmp).get(), out);
+
+  fputs(">\n", out);
+}
+
+void
+CDATASection::DumpContent(FILE* out, int32_t aIndent,
+                               bool aDumpAll) const {
+}
+#endif
+
+} // namespace mozilla
+} // namespace dom
diff --git a/content/xml/content/src/CDATASection.h b/content/xml/content/src/CDATASection.h
new file mode 100644
index 000000000000..e726b6504bd2
--- /dev/null
+++ b/content/xml/content/src/CDATASection.h
@@ -0,0 +1,65 @@
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_dom_CDATASection_h
+#define mozilla_dom_CDATASection_h
+
+#include "nsIDOMCDATASection.h"
+#include "nsGenericDOMDataNode.h"
+
+namespace mozilla {
+namespace dom {
+
+class CDATASection : public nsGenericDOMDataNode,
+                     public nsIDOMCDATASection
+{
+public:
+  CDATASection(already_AddRefed<nsINodeInfo> aNodeInfo)
+    : nsGenericDOMDataNode(aNodeInfo)
+  {
+    NS_ABORT_IF_FALSE(mNodeInfo->NodeType() == nsIDOMNode::CDATA_SECTION_NODE,
+                      "Bad NodeType in aNodeInfo");
+    SetIsDOMBinding();
+  }
+  virtual ~CDATASection();
+
+  // nsISupports
+  NS_DECL_ISUPPORTS_INHERITED
+
+  // nsIDOMNode
+  NS_FORWARD_NSIDOMNODE_TO_NSINODE
+
+  // nsIDOMCharacterData
+  NS_FORWARD_NSIDOMCHARACTERDATA(nsGenericDOMDataNode::)
+
+  // nsIDOMText
+  NS_FORWARD_NSIDOMTEXT(nsGenericDOMDataNode::)
+
+  // nsIDOMCDATASection
+  // Empty interface
+
+  // nsINode
+  virtual bool IsNodeOfType(uint32_t aFlags) const;
+
+  virtual nsGenericDOMDataNode* CloneDataNode(nsINodeInfo *aNodeInfo,
+                                              bool aCloneText) const;
+
+  virtual nsXPCClassInfo* GetClassInfo();
+
+  virtual nsIDOMNode* AsDOMNode() { return this; }
+#ifdef DEBUG
+  virtual void List(FILE* out, int32_t aIndent) const;
+  virtual void DumpContent(FILE* out, int32_t aIndent,bool aDumpAll) const;
+#endif
+
+protected:
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
+                             bool *aTriedToWrap) MOZ_OVERRIDE;
+};
+
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_CDATASection_h
diff --git a/content/xml/content/src/Makefile.in b/content/xml/content/src/Makefile.in
index 46f30b02e1f8..1202f1fde77c 100644
--- a/content/xml/content/src/Makefile.in
+++ b/content/xml/content/src/Makefile.in
@@ -15,10 +15,17 @@ LIBRARY_NAME	= gkconxmlcon_s
 LIBXUL_LIBRARY	= 1
 FAIL_ON_WARNINGS = 1
 
+EXPORTS_NAMESPACES = mozilla/dom
+
+EXPORTS_mozilla/dom = \
+  CDATASection.h \
+  ProcessingInstruction.h \
+  $(NULL)
+
 CPPSRCS		= \
 		nsXMLElement.cpp \
-		nsXMLCDATASection.cpp \
-		nsXMLProcessingInstruction.cpp \
+		CDATASection.cpp \
+		ProcessingInstruction.cpp \
 		nsXMLStylesheetPI.cpp \
 		$(NULL)
 
diff --git a/content/xml/content/src/nsXMLProcessingInstruction.cpp b/content/xml/content/src/ProcessingInstruction.cpp
similarity index 61%
rename from content/xml/content/src/nsXMLProcessingInstruction.cpp
rename to content/xml/content/src/ProcessingInstruction.cpp
index 4a9168a470dc..661b1517b74e 100644
--- a/content/xml/content/src/nsXMLProcessingInstruction.cpp
+++ b/content/xml/content/src/ProcessingInstruction.cpp
@@ -5,7 +5,8 @@
 
 #include "nsGkAtoms.h"
 #include "nsUnicharUtils.h"
-#include "nsXMLProcessingInstruction.h"
+#include "mozilla/dom/ProcessingInstruction.h"
+#include "mozilla/dom/ProcessingInstructionBinding.h"
 #include "nsContentCreatorFunctions.h"
 #include "nsContentUtils.h"
 
@@ -15,6 +16,8 @@ NS_NewXMLProcessingInstruction(nsIContent** aInstancePtrResult,
                                const nsAString& aTarget,
                                const nsAString& aData)
 {
+  using mozilla::dom::ProcessingInstruction;
+
   NS_PRECONDITION(aNodeInfoManager, "Missing nodeinfo manager");
 
   nsCOMPtr<nsIAtom> target = do_GetAtom(aTarget);
@@ -34,8 +37,8 @@ NS_NewXMLProcessingInstruction(nsIContent** aInstancePtrResult,
                                      target);
   NS_ENSURE_TRUE(ni, NS_ERROR_OUT_OF_MEMORY);
 
-  nsXMLProcessingInstruction *instance =
-    new nsXMLProcessingInstruction(ni.forget(), aData);
+  ProcessingInstruction *instance =
+    new ProcessingInstruction(ni.forget(), aData);
   if (!instance) {
     return NS_ERROR_OUT_OF_MEMORY;
   }
@@ -45,8 +48,13 @@ NS_NewXMLProcessingInstruction(nsIContent** aInstancePtrResult,
   return NS_OK;
 }
 
-nsXMLProcessingInstruction::nsXMLProcessingInstruction(already_AddRefed<nsINodeInfo> aNodeInfo,
-                                                       const nsAString& aData)
+DOMCI_NODE_DATA(ProcessingInstruction, mozilla::dom::ProcessingInstruction)
+
+namespace mozilla {
+namespace dom {
+
+ProcessingInstruction::ProcessingInstruction(already_AddRefed<nsINodeInfo> aNodeInfo,
+                                             const nsAString& aData)
   : nsGenericDOMDataNode(aNodeInfo)
 {
   NS_ABORT_IF_FALSE(mNodeInfo->NodeType() ==
@@ -56,21 +64,20 @@ nsXMLProcessingInstruction::nsXMLProcessingInstruction(already_AddRefed<nsINodeI
   SetTextInternal(0, mText.GetLength(),
                   aData.BeginReading(), aData.Length(),
                   false);  // Don't notify (bug 420429).
+
+  SetIsDOMBinding();
 }
 
-nsXMLProcessingInstruction::~nsXMLProcessingInstruction()
+ProcessingInstruction::~ProcessingInstruction()
 {
 }
 
-
-DOMCI_NODE_DATA(ProcessingInstruction, nsXMLProcessingInstruction)
-
-// QueryInterface implementation for nsXMLProcessingInstruction
-NS_INTERFACE_TABLE_HEAD(nsXMLProcessingInstruction)
-  NS_NODE_OFFSET_AND_INTERFACE_TABLE_BEGIN(nsXMLProcessingInstruction)
-    NS_INTERFACE_TABLE_ENTRY(nsXMLProcessingInstruction, nsIDOMNode)
-    NS_INTERFACE_TABLE_ENTRY(nsXMLProcessingInstruction, nsIDOMCharacterData)
-    NS_INTERFACE_TABLE_ENTRY(nsXMLProcessingInstruction,
+// QueryInterface implementation for ProcessingInstruction
+NS_INTERFACE_TABLE_HEAD(ProcessingInstruction)
+  NS_NODE_OFFSET_AND_INTERFACE_TABLE_BEGIN(ProcessingInstruction)
+    NS_INTERFACE_TABLE_ENTRY(ProcessingInstruction, nsIDOMNode)
+    NS_INTERFACE_TABLE_ENTRY(ProcessingInstruction, nsIDOMCharacterData)
+    NS_INTERFACE_TABLE_ENTRY(ProcessingInstruction,
                              nsIDOMProcessingInstruction)
   NS_OFFSET_AND_INTERFACE_TABLE_END
   NS_OFFSET_AND_INTERFACE_TABLE_TO_MAP_SEGUE
@@ -78,12 +85,17 @@ NS_INTERFACE_TABLE_HEAD(nsXMLProcessingInstruction)
 NS_INTERFACE_MAP_END_INHERITING(nsGenericDOMDataNode)
 
 
-NS_IMPL_ADDREF_INHERITED(nsXMLProcessingInstruction, nsGenericDOMDataNode)
-NS_IMPL_RELEASE_INHERITED(nsXMLProcessingInstruction, nsGenericDOMDataNode)
+NS_IMPL_ADDREF_INHERITED(ProcessingInstruction, nsGenericDOMDataNode)
+NS_IMPL_RELEASE_INHERITED(ProcessingInstruction, nsGenericDOMDataNode)
 
+JSObject*
+ProcessingInstruction::WrapNode(JSContext *aCx, JSObject *aScope, bool *aTriedToWrap)
+{
+  return ProcessingInstructionBinding::Wrap(aCx, aScope, this, aTriedToWrap);
+}
 
 NS_IMETHODIMP
-nsXMLProcessingInstruction::GetTarget(nsAString& aTarget)
+ProcessingInstruction::GetTarget(nsAString& aTarget)
 {
   aTarget = NodeName();
 
@@ -91,7 +103,7 @@ nsXMLProcessingInstruction::GetTarget(nsAString& aTarget)
 }
 
 bool
-nsXMLProcessingInstruction::GetAttrValue(nsIAtom *aName, nsAString& aValue)
+ProcessingInstruction::GetAttrValue(nsIAtom *aName, nsAString& aValue)
 {
   nsAutoString data;
 
@@ -100,24 +112,24 @@ nsXMLProcessingInstruction::GetAttrValue(nsIAtom *aName, nsAString& aValue)
 }
 
 bool
-nsXMLProcessingInstruction::IsNodeOfType(uint32_t aFlags) const
+ProcessingInstruction::IsNodeOfType(uint32_t aFlags) const
 {
   return !(aFlags & ~(eCONTENT | ePROCESSING_INSTRUCTION | eDATA_NODE));
 }
 
 nsGenericDOMDataNode*
-nsXMLProcessingInstruction::CloneDataNode(nsINodeInfo *aNodeInfo,
-                                          bool aCloneText) const
+ProcessingInstruction::CloneDataNode(nsINodeInfo *aNodeInfo,
+                                     bool aCloneText) const
 {
   nsAutoString data;
   nsGenericDOMDataNode::GetData(data);
   nsCOMPtr<nsINodeInfo> ni = aNodeInfo;
-  return new nsXMLProcessingInstruction(ni.forget(), data);
+  return new ProcessingInstruction(ni.forget(), data);
 }
 
 #ifdef DEBUG
 void
-nsXMLProcessingInstruction::List(FILE* out, int32_t aIndent) const
+ProcessingInstruction::List(FILE* out, int32_t aIndent) const
 {
   int32_t index;
   for (index = aIndent; --index >= 0; ) fputs("  ", out);
@@ -133,8 +145,11 @@ nsXMLProcessingInstruction::List(FILE* out, int32_t aIndent) const
 }
 
 void
-nsXMLProcessingInstruction::DumpContent(FILE* out, int32_t aIndent,
-                                        bool aDumpAll) const
+ProcessingInstruction::DumpContent(FILE* out, int32_t aIndent,
+                                   bool aDumpAll) const
 {
 }
 #endif
+
+} // namespace dom
+} // namespace mozilla
diff --git a/content/xml/content/src/nsXMLProcessingInstruction.h b/content/xml/content/src/ProcessingInstruction.h
similarity index 70%
rename from content/xml/content/src/nsXMLProcessingInstruction.h
rename to content/xml/content/src/ProcessingInstruction.h
index 0f4fcd93528c..c35539611cc3 100644
--- a/content/xml/content/src/nsXMLProcessingInstruction.h
+++ b/content/xml/content/src/ProcessingInstruction.h
@@ -3,21 +3,23 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#ifndef nsIXMLProcessingInstruction_h___
-#define nsIXMLProcessingInstruction_h___
+#ifndef mozilla_dom_ProcessingInstruction_h
+#define mozilla_dom_ProcessingInstruction_h
 
 #include "nsIDOMProcessingInstruction.h"
 #include "nsGenericDOMDataNode.h"
 #include "nsAString.h"
 
+namespace mozilla {
+namespace dom {
 
-class nsXMLProcessingInstruction : public nsGenericDOMDataNode,
-                                   public nsIDOMProcessingInstruction
+class ProcessingInstruction : public nsGenericDOMDataNode,
+                              public nsIDOMProcessingInstruction
 {
 public:
-  nsXMLProcessingInstruction(already_AddRefed<nsINodeInfo> aNodeInfo,
-                             const nsAString& aData);
-  virtual ~nsXMLProcessingInstruction();
+  ProcessingInstruction(already_AddRefed<nsINodeInfo> aNodeInfo,
+                        const nsAString& aData);
+  virtual ~ProcessingInstruction();
 
   // nsISupports
   NS_DECL_ISUPPORTS_INHERITED
@@ -45,6 +47,12 @@ public:
   virtual nsXPCClassInfo* GetClassInfo();
 
   virtual nsIDOMNode* AsDOMNode() { return this; }
+
+  // WebIDL API
+  void GetTarget(nsString& aTarget)
+  {
+    aTarget = NodeName();
+  }
 protected:
   /**
    * This will parse the content of the PI, to extract the value of the pseudo
@@ -57,6 +65,12 @@ protected:
    *                     aAttribute. Empty if the attribute isn't present.
    */
   bool GetAttrValue(nsIAtom *aName, nsAString& aValue);
+
+  virtual JSObject* WrapNode(JSContext *aCx, JSObject *aScope,
+                             bool *aTriedToWrap) MOZ_OVERRIDE;
 };
 
-#endif //nsIXMLProcessingInstruction_h___
+} // namespace dom
+} // namespace mozilla
+
+#endif // mozilla_dom_ProcessingInstruction_h
diff --git a/content/xml/content/src/nsXMLCDATASection.cpp b/content/xml/content/src/nsXMLCDATASection.cpp
deleted file mode 100644
index 572e6fe964b3..000000000000
--- a/content/xml/content/src/nsXMLCDATASection.cpp
+++ /dev/null
@@ -1,134 +0,0 @@
-/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#include "nsIDOMCDATASection.h"
-#include "nsGenericDOMDataNode.h"
-#include "nsGkAtoms.h"
-
-class nsXMLCDATASection : public nsGenericDOMDataNode,
-                          public nsIDOMCDATASection
-{
-public:
-  nsXMLCDATASection(already_AddRefed<nsINodeInfo> aNodeInfo);
-  virtual ~nsXMLCDATASection();
-
-  // nsISupports
-  NS_DECL_ISUPPORTS_INHERITED
-
-  // nsIDOMNode
-  NS_FORWARD_NSIDOMNODE_TO_NSINODE
-
-  // nsIDOMCharacterData
-  NS_FORWARD_NSIDOMCHARACTERDATA(nsGenericDOMDataNode::)
-
-  // nsIDOMText
-  NS_FORWARD_NSIDOMTEXT(nsGenericDOMDataNode::)
-
-  // nsIDOMCDATASection
-  // Empty interface
-
-  // nsINode
-  virtual bool IsNodeOfType(uint32_t aFlags) const;
-
-  virtual nsGenericDOMDataNode* CloneDataNode(nsINodeInfo *aNodeInfo,
-                                              bool aCloneText) const;
-
-  virtual nsXPCClassInfo* GetClassInfo();
-
-  virtual nsIDOMNode* AsDOMNode() { return this; }
-#ifdef DEBUG
-  virtual void List(FILE* out, int32_t aIndent) const;
-  virtual void DumpContent(FILE* out, int32_t aIndent,bool aDumpAll) const;
-#endif
-};
-
-nsresult
-NS_NewXMLCDATASection(nsIContent** aInstancePtrResult,
-                      nsNodeInfoManager *aNodeInfoManager)
-{
-  NS_PRECONDITION(aNodeInfoManager, "Missing nodeinfo manager");
-
-  *aInstancePtrResult = nullptr;
-
-  nsCOMPtr<nsINodeInfo> ni;
-  ni = aNodeInfoManager->GetNodeInfo(nsGkAtoms::cdataTagName,
-                                     nullptr, kNameSpaceID_None,
-                                     nsIDOMNode::CDATA_SECTION_NODE);
-  NS_ENSURE_TRUE(ni, NS_ERROR_OUT_OF_MEMORY);
-
-  nsXMLCDATASection *instance = new nsXMLCDATASection(ni.forget());
-  if (!instance) {
-    return NS_ERROR_OUT_OF_MEMORY;
-  }
-
-  NS_ADDREF(*aInstancePtrResult = instance);
-
-  return NS_OK;
-}
-
-nsXMLCDATASection::nsXMLCDATASection(already_AddRefed<nsINodeInfo> aNodeInfo)
-  : nsGenericDOMDataNode(aNodeInfo)
-{
-  NS_ABORT_IF_FALSE(mNodeInfo->NodeType() == nsIDOMNode::CDATA_SECTION_NODE,
-                    "Bad NodeType in aNodeInfo");
-}
-
-nsXMLCDATASection::~nsXMLCDATASection()
-{
-}
-
-
-DOMCI_NODE_DATA(CDATASection, nsXMLCDATASection)
-
-// QueryInterface implementation for nsXMLCDATASection
-NS_INTERFACE_TABLE_HEAD(nsXMLCDATASection)
-  NS_NODE_INTERFACE_TABLE4(nsXMLCDATASection, nsIDOMNode, nsIDOMCharacterData,
-                           nsIDOMText, nsIDOMCDATASection)
-  NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(CDATASection)
-NS_INTERFACE_MAP_END_INHERITING(nsGenericDOMDataNode)
-
-NS_IMPL_ADDREF_INHERITED(nsXMLCDATASection, nsGenericDOMDataNode)
-NS_IMPL_RELEASE_INHERITED(nsXMLCDATASection, nsGenericDOMDataNode)
-
-
-bool
-nsXMLCDATASection::IsNodeOfType(uint32_t aFlags) const
-{
-  return !(aFlags & ~(eCONTENT | eTEXT | eDATA_NODE));
-}
-
-nsGenericDOMDataNode*
-nsXMLCDATASection::CloneDataNode(nsINodeInfo *aNodeInfo, bool aCloneText) const
-{
-  nsCOMPtr<nsINodeInfo> ni = aNodeInfo;
-  nsXMLCDATASection *it = new nsXMLCDATASection(ni.forget());
-  if (it && aCloneText) {
-    it->mText = mText;
-  }
-
-  return it;
-}
-
-#ifdef DEBUG
-void
-nsXMLCDATASection::List(FILE* out, int32_t aIndent) const
-{
-  int32_t index;
-  for (index = aIndent; --index >= 0; ) fputs("  ", out);
-
-  fprintf(out, "CDATASection refcount=%d<", mRefCnt.get());
-
-  nsAutoString tmp;
-  ToCString(tmp, 0, mText.GetLength());
-  fputs(NS_LossyConvertUTF16toASCII(tmp).get(), out);
-
-  fputs(">\n", out);
-}
-
-void
-nsXMLCDATASection::DumpContent(FILE* out, int32_t aIndent,
-                               bool aDumpAll) const {
-}
-#endif
diff --git a/content/xml/content/src/nsXMLStylesheetPI.cpp b/content/xml/content/src/nsXMLStylesheetPI.cpp
index ec9d7c021ca4..0d419e100231 100644
--- a/content/xml/content/src/nsXMLStylesheetPI.cpp
+++ b/content/xml/content/src/nsXMLStylesheetPI.cpp
@@ -3,6 +3,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "mozilla/dom/Element.h"
 #include "nsIDOMLinkStyle.h"
 #include "nsIDOMStyleSheet.h"
 #include "nsIDocument.h"
@@ -10,15 +11,16 @@
 #include "nsIURI.h"
 #include "nsStyleLinkElement.h"
 #include "nsNetUtil.h"
-#include "nsXMLProcessingInstruction.h"
+#include "mozilla/dom/ProcessingInstruction.h"
 #include "nsUnicharUtils.h"
 #include "nsGkAtoms.h"
 #include "nsThreadUtils.h"
 #include "nsContentUtils.h"
 
 using namespace mozilla;
+using namespace dom;
 
-class nsXMLStylesheetPI : public nsXMLProcessingInstruction,
+class nsXMLStylesheetPI : public ProcessingInstruction,
                           public nsStyleLinkElement
 {
 public:
@@ -30,7 +32,7 @@ public:
 
   // CC
   NS_DECL_CYCLE_COLLECTION_CLASS_INHERITED(nsXMLStylesheetPI,
-                                           nsXMLProcessingInstruction)
+                                           ProcessingInstruction)
 
   // nsIDOMNode
   virtual void SetNodeValueInternal(const nsAString& aNodeValue,
@@ -57,6 +59,7 @@ protected:
   void GetStyleSheetInfo(nsAString& aTitle,
                          nsAString& aType,
                          nsAString& aMedia,
+                         bool* aIsScoped,
                          bool* aIsAlternate);
   virtual nsGenericDOMDataNode* CloneDataNode(nsINodeInfo *aNodeInfo,
                                               bool aCloneText) const;
@@ -71,25 +74,25 @@ NS_INTERFACE_TABLE_HEAD_CYCLE_COLLECTION_INHERITED(nsXMLStylesheetPI)
                            nsIDOMProcessingInstruction, nsIDOMLinkStyle,
                            nsIStyleSheetLinkingElement)
   NS_DOM_INTERFACE_MAP_ENTRY_CLASSINFO(XMLStylesheetProcessingInstruction)
-NS_INTERFACE_MAP_END_INHERITING(nsXMLProcessingInstruction)
+NS_INTERFACE_MAP_END_INHERITING(ProcessingInstruction)
 
-NS_IMPL_ADDREF_INHERITED(nsXMLStylesheetPI, nsXMLProcessingInstruction)
-NS_IMPL_RELEASE_INHERITED(nsXMLStylesheetPI, nsXMLProcessingInstruction)
+NS_IMPL_ADDREF_INHERITED(nsXMLStylesheetPI, ProcessingInstruction)
+NS_IMPL_RELEASE_INHERITED(nsXMLStylesheetPI, ProcessingInstruction)
 
 NS_IMPL_CYCLE_COLLECTION_CLASS(nsXMLStylesheetPI)
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN_INHERITED(nsXMLStylesheetPI,
-                                                  nsXMLProcessingInstruction)
+                                                  ProcessingInstruction)
   tmp->nsStyleLinkElement::Traverse(cb);
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN_INHERITED(nsXMLStylesheetPI,
-                                                nsXMLProcessingInstruction)
+                                                ProcessingInstruction)
   tmp->nsStyleLinkElement::Unlink();
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 
 
 nsXMLStylesheetPI::nsXMLStylesheetPI(already_AddRefed<nsINodeInfo> aNodeInfo,
                                      const nsAString& aData)
-  : nsXMLProcessingInstruction(aNodeInfo, aData)
+  : ProcessingInstruction(aNodeInfo, aData)
 {
 }
 
@@ -104,9 +107,9 @@ nsXMLStylesheetPI::BindToTree(nsIDocument* aDocument, nsIContent* aParent,
                               nsIContent* aBindingParent,
                               bool aCompileEventHandlers)
 {
-  nsresult rv = nsXMLProcessingInstruction::BindToTree(aDocument, aParent,
-                                                       aBindingParent,
-                                                       aCompileEventHandlers);
+  nsresult rv = ProcessingInstruction::BindToTree(aDocument, aParent,
+                                                  aBindingParent,
+                                                  aCompileEventHandlers);
   NS_ENSURE_SUCCESS(rv, rv);
 
   void (nsXMLStylesheetPI::*update)() = &nsXMLStylesheetPI::UpdateStyleSheetInternal;
@@ -120,7 +123,7 @@ nsXMLStylesheetPI::UnbindFromTree(bool aDeep, bool aNullParent)
 {
   nsCOMPtr<nsIDocument> oldDoc = GetCurrentDoc();
 
-  nsXMLProcessingInstruction::UnbindFromTree(aDeep, aNullParent);
+  ProcessingInstruction::UnbindFromTree(aDeep, aNullParent);
   UpdateStyleSheetInternal(oldDoc);
 }
 
@@ -177,11 +180,13 @@ void
 nsXMLStylesheetPI::GetStyleSheetInfo(nsAString& aTitle,
                                      nsAString& aType,
                                      nsAString& aMedia,
+                                     bool* aIsScoped,
                                      bool* aIsAlternate)
 {
   aTitle.Truncate();
   aType.Truncate();
   aMedia.Truncate();
+  *aIsScoped = false;
   *aIsAlternate = false;
 
   // xml-stylesheet PI is special only in prolog
diff --git a/docshell/base/nsDocShell.cpp b/docshell/base/nsDocShell.cpp
index f4f10dabb371..70b465e27bc9 100644
--- a/docshell/base/nsDocShell.cpp
+++ b/docshell/base/nsDocShell.cpp
@@ -193,7 +193,10 @@
 #include "mozilla/Telemetry.h"
 #include "nsISecurityUITelemetry.h"
 
-#ifndef MOZ_PER_WINDOW_PRIVATE_BROWSING
+#ifdef MOZ_PER_WINDOW_PRIVATE_BROWSING
+#include "nsIAppShellService.h"
+#include "nsAppShellCID.h"
+#else
 #include "nsIPrivateBrowsingService.h"
 #endif
 
@@ -220,9 +223,9 @@ static uint32_t gNumberOfPrivateDocShells = 0;
 
 // Global count of private docshells which will always remain open
 #ifdef MOZ_PER_WINDOW_PRIVATE_BROWSING
-static const uint32_t kNumberOfAlwaysOpenPrivateDocShells = 1; // the private hidden window
+static uint32_t gNumberOfAlwaysOpenPrivateDocShells = 0; // the private hidden window
 #else
-static const uint32_t kNumberOfAlwaysOpenPrivateDocShells = 0;
+static const uint32_t gNumberOfAlwaysOpenPrivateDocShells = 0;
 #endif
 
 // Global reference to the URI fixup service.
@@ -688,11 +691,27 @@ ConvertLoadTypeToNavigationType(uint32_t aLoadType)
 
 static nsISHEntry* GetRootSHEntry(nsISHEntry *entry);
 
+static void
+AdjustAlwaysOpenPrivateDocShellCount()
+{
+#ifdef MOZ_PER_WINDOW_PRIVATE_BROWSING
+    nsCOMPtr<nsIAppShellService> appShell
+      (do_GetService(NS_APPSHELLSERVICE_CONTRACTID));
+    bool hasHiddenPrivateWindow = false;
+    if (appShell) {
+      appShell->GetHasHiddenPrivateWindow(&hasHiddenPrivateWindow);
+    }
+    gNumberOfAlwaysOpenPrivateDocShells = hasHiddenPrivateWindow ? 1 : 0;
+#endif
+}
+
 static void
 IncreasePrivateDocShellCount()
 {
+    AdjustAlwaysOpenPrivateDocShellCount();
+
     gNumberOfPrivateDocShells++;
-    if (gNumberOfPrivateDocShells > kNumberOfAlwaysOpenPrivateDocShells + 1 ||
+    if (gNumberOfPrivateDocShells > gNumberOfAlwaysOpenPrivateDocShells + 1 ||
         XRE_GetProcessType() != GeckoProcessType_Content) {
         return;
     }
@@ -704,9 +723,11 @@ IncreasePrivateDocShellCount()
 static void
 DecreasePrivateDocShellCount()
 {
+    AdjustAlwaysOpenPrivateDocShellCount();
+
     MOZ_ASSERT(gNumberOfPrivateDocShells > 0);
     gNumberOfPrivateDocShells--;
-    if (gNumberOfPrivateDocShells == kNumberOfAlwaysOpenPrivateDocShells)
+    if (gNumberOfPrivateDocShells == gNumberOfAlwaysOpenPrivateDocShells)
     {
         if (XRE_GetProcessType() == GeckoProcessType_Content) {
             mozilla::dom::ContentChild* cc = mozilla::dom::ContentChild::GetSingleton();
@@ -8651,6 +8672,8 @@ nsDocShell::InternalLoad(nsIURI * aURI,
         return NS_ERROR_FAILURE;
     }
 
+    NS_ENSURE_STATE(!HasUnloadedParent());
+
     rv = CheckLoadingPermissions();
     if (NS_FAILED(rv)) {
         return rv;
@@ -12440,3 +12463,23 @@ nsDocShell::GetAsyncPanZoomEnabled(bool* aOut)
     *aOut = false;
     return NS_OK;
 }
+
+bool
+nsDocShell::HasUnloadedParent()
+{
+    nsCOMPtr<nsIDocShellTreeItem> currentTreeItem = this;
+    while (currentTreeItem) {
+        nsCOMPtr<nsIDocShellTreeItem> parentTreeItem;
+        currentTreeItem->GetParent(getter_AddRefs(parentTreeItem));
+        nsCOMPtr<nsIDocShell> parent = do_QueryInterface(parentTreeItem);
+        if (parent) {
+            bool inUnload = false;
+            parent->GetIsInUnload(&inUnload);
+            if (inUnload) {
+                return true;
+            }
+        }
+        currentTreeItem.swap(parentTreeItem);
+    }
+    return false;
+}
diff --git a/docshell/base/nsDocShell.h b/docshell/base/nsDocShell.h
index 383cf2c56551..9ff0d494f244 100644
--- a/docshell/base/nsDocShell.h
+++ b/docshell/base/nsDocShell.h
@@ -675,6 +675,8 @@ protected:
 
     FrameType GetInheritedFrameType();
 
+    bool HasUnloadedParent();
+
     // hash of session storages, keyed by domain
     nsInterfaceHashtable<nsCStringHashKey, nsIDOMStorage> mStorages;
 
diff --git a/dom/activities/src/ActivitiesService.jsm b/dom/activities/src/ActivitiesService.jsm
index e8bad41a3713..8c3ae9c4c570 100644
--- a/dom/activities/src/ActivitiesService.jsm
+++ b/dom/activities/src/ActivitiesService.jsm
@@ -52,7 +52,6 @@ ActivitiesDb.prototype = {
    *  id:                  String
    *  manifest:            String
    *  name:                String
-   *  title:               String
    *  icon:                String
    *  description:         jsval
    * }
@@ -94,7 +93,6 @@ ActivitiesDb.prototype = {
         let object = {
           manifest: aObject.manifest,
           name: aObject.name,
-          title: aObject.title || "",
           icon: aObject.icon || "",
           description: aObject.description
         };
@@ -140,7 +138,6 @@ ActivitiesDb.prototype = {
 
           txn.result.options.push({
             manifest: result.manifest,
-            title: result.title,
             icon: result.icon,
             description: result.description
           });
diff --git a/dom/alarm/AlarmService.jsm b/dom/alarm/AlarmService.jsm
index f9500e9982e6..d28152f6f96c 100644
--- a/dom/alarm/AlarmService.jsm
+++ b/dom/alarm/AlarmService.jsm
@@ -83,19 +83,23 @@ this.AlarmService = {
 
   receiveMessage: function receiveMessage(aMessage) {
     debug("receiveMessage(): " + aMessage.name);
+    let json = aMessage.json;
 
-    // To prevent hacked child processes from sending commands to parent
-    // to schedule alarms, we need to check their installed permissions.
+    // To prevent the hacked child process from sending commands to parent
+    // to schedule alarms, we need to check its permission and manifest URL.
     if (["AlarmsManager:GetAll", "AlarmsManager:Add", "AlarmsManager:Remove"]
           .indexOf(aMessage.name) != -1) {
       if (!aMessage.target.assertPermission("alarms")) {
         debug("Got message from a child process with no 'alarms' permission.");
         return null;
       }
+      if (!aMessage.target.assertContainApp(json.manifestURL)) {
+        debug("Got message from a child process containing illegal manifest URL.");
+        return null;
+      }
     }
 
     let mm = aMessage.target.QueryInterface(Ci.nsIMessageSender);
-    let json = aMessage.json;
     switch (aMessage.name) {
       case "AlarmsManager:GetAll":
         this._db.getAll(
diff --git a/dom/apps/src/AppsUtils.jsm b/dom/apps/src/AppsUtils.jsm
index eb7fcd65c3d0..2b64923e4572 100644
--- a/dom/apps/src/AppsUtils.jsm
+++ b/dom/apps/src/AppsUtils.jsm
@@ -25,6 +25,13 @@ function debug(s) {
   //dump("-*- AppsUtils.jsm: " + s + "\n");
 }
 
+function isAbsoluteURI(aURI) {
+  let foo = Services.io.newURI("http://foo", null, null);
+  let bar = Services.io.newURI("http://bar", null, null);
+  return Services.io.newURI(aURI, null, foo).prePath != foo.prePath ||
+         Services.io.newURI(aURI, null, bar).prePath != bar.prePath;
+}
+
 this.AppsUtils = {
   // Clones a app, without the manifest.
   cloneAppObject: function cloneAppObject(aApp) {
@@ -161,21 +168,13 @@ this.AppsUtils = {
     if (aManifest.name == undefined)
       return false;
 
-    function isAbsolute(uri) {
-      // See bug 810551
-      let foo = Services.io.newURI("http://foo", null, null);
-      let bar = Services.io.newURI("http://bar", null, null);
-      return Services.io.newURI(uri, null, foo).prePath != foo.prePath ||
-             Services.io.newURI(uri, null, bar).prePath != bar.prePath;
-    }
-
-    // launch_path and entry_points launch paths can't be absolute
-    if (aManifest.launch_path && isAbsolute(aManifest.launch_path))
+    // launch_path, entry_points launch paths, message hrefs, and activity hrefs can't be absolute
+    if (aManifest.launch_path && isAbsoluteURI(aManifest.launch_path))
       return false;
 
     function checkAbsoluteEntryPoints(entryPoints) {
       for (let name in entryPoints) {
-        if (entryPoints[name].launch_path && isAbsolute(entryPoints[name].launch_path)) {
+        if (entryPoints[name].launch_path && isAbsoluteURI(entryPoints[name].launch_path)) {
           return true;
         }
       }
@@ -191,6 +190,35 @@ this.AppsUtils = {
       }
     }
 
+    if (aManifest.activities) {
+      for (let activityName in aManifest.activities) {
+        let activity = aManifest.activities[activityName];
+        if (activity.href && isAbsoluteURI(activity.href)) {
+          return false;
+        }
+      }
+    }
+
+    // |messages| is an array of items, where each item is either a string or
+    // a {name: href} object.
+    let messages = aManifest.messages;
+    if (messages) {
+      if (!Array.isArray(messages)) {
+        return false;
+      }
+      for (let item of aManifest.messages) {
+        if (typeof item == "object") {
+          let keys = Object.keys(item);
+          if (keys.length != 1) {
+            return false;
+          }
+          if (isAbsoluteURI(item[keys[0]])) {
+            return false;
+          }
+        }
+      }
+    }
+
     return true;
   },
 
@@ -440,6 +468,10 @@ ManifestHelper.prototype = {
   },
 
   resolveFromOrigin: function(aURI) {
+    // This should be enforced higher up, but check it here just in case.
+    if (isAbsoluteURI(aURI)) {
+      throw new Error("Webapps.jsm: non-relative URI passed to resolveFromOrigin");
+    }
     return this._origin.resolve(aURI);
   },
 
diff --git a/dom/apps/src/PermissionsTable.jsm b/dom/apps/src/PermissionsTable.jsm
index 52b69c65e135..9dd0132c1060 100644
--- a/dom/apps/src/PermissionsTable.jsm
+++ b/dom/apps/src/PermissionsTable.jsm
@@ -36,7 +36,7 @@ const PROMPT_ACTION = Ci.nsIPermissionManager.PROMPT_ACTION;
 this.PermissionsTable =  { geolocation: {
                              app: PROMPT_ACTION,
                              privileged: PROMPT_ACTION,
-                             certified: ALLOW_ACTION
+                             certified: PROMPT_ACTION
                            },
                            camera: {
                              app: DENY_ACTION,
diff --git a/dom/apps/src/Webapps.js b/dom/apps/src/Webapps.js
index 93256325fcd1..4ea2aced1d2e 100644
--- a/dom/apps/src/Webapps.js
+++ b/dom/apps/src/Webapps.js
@@ -82,13 +82,38 @@ WebappsRegistry.prototype = {
     }
   },
 
+  // Checks that we run as a foreground page, and fire an error on the
+  // DOM Request if we aren't.
+  _ensureForeground: function(aRequest) {
+    let docShell = this._window.QueryInterface(Ci.nsIInterfaceRequestor)
+                               .getInterface(Ci.nsIWebNavigation)
+                               .QueryInterface(Ci.nsIDocShell);
+    if (docShell.isActive) {
+      return true;
+    }
+
+    let runnable = {
+      run: function run() {
+        Services.DOMRequest.fireError(aRequest, "BACKGROUND_APP");
+      }
+    }
+    Services.tm.currentThread.dispatch(runnable,
+                                       Ci.nsIThread.DISPATCH_NORMAL);
+    return false;
+  },
+
   // mozIDOMApplicationRegistry implementation
 
   install: function(aURL, aParams) {
+    let request = this.createRequest();
+
+    if (!this._ensureForeground(request)) {
+      return request;
+    }
+
     this._validateScheme(aURL);
 
     let installURL = this._window.location.href;
-    let request = this.createRequest();
     let requestID = this.getRequestId(request);
     let receipts = (aParams && aParams.receipts &&
                     Array.isArray(aParams.receipts)) ? aParams.receipts
@@ -159,10 +184,15 @@ WebappsRegistry.prototype = {
   // mozIDOMApplicationRegistry2 implementation
 
   installPackage: function(aURL, aParams) {
+    let request = this.createRequest();
+
+    if (!this._ensureForeground(request)) {
+      return request;
+    }
+
     this._validateScheme(aURL);
 
     let installURL = this._window.location.href;
-    let request = this.createRequest();
     let requestID = this.getRequestId(request);
     let receipts = (aParams && aParams.receipts &&
                     Array.isArray(aParams.receipts)) ? aParams.receipts
diff --git a/dom/apps/src/Webapps.jsm b/dom/apps/src/Webapps.jsm
index 88de1c38b479..278285a6a51f 100644
--- a/dom/apps/src/Webapps.jsm
+++ b/dom/apps/src/Webapps.jsm
@@ -241,7 +241,6 @@ this.DOMApplicationRegistry = {
 
     // We copy this app to DIRECTORY_NAME/$aId, and set the base path as needed.
     let destDir = FileUtils.getDir(DIRECTORY_NAME, ["webapps", aId], true, true);
-    destDir.permissions = FileUtils.PERMS_DIRECTORY;
 
     ["application.zip", "update.webapp"]
       .forEach(function(aFile) {
@@ -250,7 +249,6 @@ this.DOMApplicationRegistry = {
         file.copyTo(destDir, aFile);
         let newFile = destDir.clone();
         newFile.append(aFile);
-        newFile.permissions = FileUtils.PERMS_FILE;
       });
 
     app.basePath = FileUtils.getDir(DIRECTORY_NAME, ["webapps"], true, true)
@@ -272,7 +270,6 @@ this.DOMApplicationRegistry = {
       let manifestFile = destDir.clone();
       manifestFile.append("manifest.webapp");
       zipReader.extract("manifest.webapp", manifestFile);
-      manifestFile.permissions = FileUtils.PERMS_FILE;
     } catch(e) {
       // If we are unable to extract the manifest, cleanup and remove this app.
       debug("Cleaning up: " + e);
@@ -408,16 +405,6 @@ this.DOMApplicationRegistry = {
         this.installSystemApps(onAppsLoaded);
       else
         onAppsLoaded();
-
-      // XXX: To be removed as soon as the app:// protocol is remoted.
-      // See Bug 819061
-      let dir = Cc["@mozilla.org/file/local;1"].createInstance(Ci.nsIFile);
-      dir.initWithPath("/data");
-      dir.permissions = parseInt("755", 8);
-      dir.append("local");
-      dir.permissions = parseInt("755", 8);
-      dir.append("webapps");
-      dir.permissions = parseInt("755", 8);
 #else
       onAppsLoaded();
 #endif
@@ -496,7 +483,6 @@ this.DOMApplicationRegistry = {
       if (aRunUpdate) {
         activitiesToRegister.push({ "manifest": aApp.manifestURL,
                                     "name": activity,
-                                    "title": manifest.name,
                                     "icon": manifest.iconURLForSize(128),
                                     "description": description });
       }
@@ -833,6 +819,8 @@ this.DOMApplicationRegistry = {
   // Webapps:Install:Return:OK
   // Webapps:Uninstall:Return:OK
   // Webapps:OfflineCache
+  // Webapps:checkForUpdate:Return:OK
+  // Webapps:PackageEvent
   broadcastMessage: function broadcastMessage(aMsgName, aContent) {
     if (!(aMsgName in this.children)) {
       return;
@@ -1036,6 +1024,12 @@ this.DOMApplicationRegistry = {
       tmpDir.remove(true);
     } catch(e) { }
 
+    // Flush the zip reader cache to make sure we use the new application.zip
+    // when re-launching the application.
+    let zipFile = dir.clone();
+    zipFile.append("application.zip");
+    Services.obs.notifyObservers(zipFile, "flush-cache-entry", null);
+
     // Get the manifest, and set properties.
     this.getManifestFor(app.origin, (function(aData) {
       app.downloading = false;
@@ -1129,6 +1123,12 @@ this.DOMApplicationRegistry = {
         return;
       }
 
+      // Store the new update manifest.
+      let dir = FileUtils.getDir(DIRECTORY_NAME, ["webapps", id], true, true);
+      let manFile = dir.clone();
+      manFile.append("update.webapp");
+      this._writeFile(manFile, JSON.stringify(aManifest), function() { });
+
       let manifest = new ManifestHelper(aManifest, app.manifestURL);
       // A package is available: set downloadAvailable to fire the matching
       // event.
@@ -1141,7 +1141,7 @@ this.DOMApplicationRegistry = {
         updateManifest: aManifest
       }
       DOMApplicationRegistry._saveApps(function() {
-        aMm.sendAsyncMessage("Webapps:CheckForUpdate:Return:OK", aData);
+        DOMApplicationRegistry.broadcastMessage("Webapps:CheckForUpdate:Return:OK", aData);
         delete aData.app.updateManifest;
       });
     }
@@ -1194,7 +1194,8 @@ this.DOMApplicationRegistry = {
         app.manifest = aManifest;
         if (!manifest.appcache_path) {
           aData.event = "downloadapplied";
-          aMm.sendAsyncMessage("Webapps:CheckForUpdate:Return:OK", aData);
+          DOMApplicationRegistry.broadcastMessage("Webapps:CheckForUpdate:Return:OK",
+                                                  aData);
         } else {
           // Check if the appcache is updatable, and send "downloadavailable" or
           // "downloadapplied".
@@ -1203,7 +1204,8 @@ this.DOMApplicationRegistry = {
               aData.event =
                 aTopic == "offline-cache-update-available" ? "downloadavailable"
                                                            : "downloadapplied";
-              aMm.sendAsyncMessage("Webapps:CheckForUpdate:Return:OK", aData);
+              DOMApplicationRegistry.broadcastMessage("Webapps:CheckForUpdate:Return:OK",
+                                                      aData);
             }
           }
           updateSvc.checkForUpdate(Services.io.newURI(aData.manifestURL, null, null),
@@ -1246,7 +1248,8 @@ this.DOMApplicationRegistry = {
             debug("appcache result: " + aTopic);
             if (aData.event == "offline-cache-update-available") {
               aData.event = "downloadavailable";
-              aMm.sendAsyncMessage("Webapps:CheckForUpdate:Return:OK", aData);
+              DOMApplicationRegistry.broadcastMessage("Webapps:CheckForUpdate:Return:OK",
+                                                      aData);
             } else {
               aData.error = "NOT_UPDATABLE";
               aMm.sendAsyncMessage("Webapps:CheckForUpdate:Return:KO", aData);
@@ -1263,6 +1266,7 @@ this.DOMApplicationRegistry = {
     let xhr = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"]
                 .createInstance(Ci.nsIXMLHttpRequest);
     xhr.open("GET", aData.manifestURL, true);
+    xhr.channel.loadFlags |= Ci.nsIRequest.INHIBIT_CACHING;
     xhr.responseType = "json";
     if (app.etag) {
       xhr.setRequestHeader("If-None-Match", app.etag);
@@ -1285,7 +1289,7 @@ this.DOMApplicationRegistry = {
           app.etag = xhr.getResponseHeader("Etag");
           app.lastCheckedUpdate = Date.now();
           if (app.origin.startsWith("app://")) {
-            updatePackagedApp(manifest);
+            updatePackagedApp.call(this, manifest);
           } else {
             updateHostedApp.call(this, manifest);
           }
@@ -1360,7 +1364,7 @@ this.DOMApplicationRegistry = {
     let xhr = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"]
                 .createInstance(Ci.nsIXMLHttpRequest);
     xhr.open("GET", app.manifestURL, true);
-    xhr.channel.loadFlags |= Ci.nsIRequest.VALIDATE_ALWAYS;
+    xhr.channel.loadFlags |= Ci.nsIRequest.INHIBIT_CACHING;
     xhr.channel.notificationCallbacks = this.createLoadContext(aData.appId,
                                                                aData.isBrowser);
     xhr.responseType = "json";
@@ -1423,7 +1427,7 @@ this.DOMApplicationRegistry = {
     let xhr = Cc["@mozilla.org/xmlextras/xmlhttprequest;1"]
                 .createInstance(Ci.nsIXMLHttpRequest);
     xhr.open("GET", app.manifestURL, true);
-    xhr.channel.loadFlags |= Ci.nsIRequest.VALIDATE_ALWAYS;
+    xhr.channel.loadFlags |= Ci.nsIRequest.INHIBIT_CACHING;
     xhr.channel.notificationCallbacks = this.createLoadContext(aData.appId,
                                                                aData.isBrowser);
     xhr.responseType = "json";
@@ -1488,6 +1492,11 @@ this.DOMApplicationRegistry = {
     let id = app.syncId || this._appId(app.origin);
     let localId = this.getAppLocalIdByManifestURL(manifestURL);
 
+    // For packaged apps, we need to get the id from the manifestURL.
+    if (localId && !id) {
+      id = this._appIdForManifestURL(manifestURL);
+    }
+
     // Installing an application again is considered as an update.
     if (id) {
       isReinstall = true;
@@ -1529,7 +1538,6 @@ this.DOMApplicationRegistry = {
     appObject.localId = localId;
     appObject.basePath = FileUtils.getDir(DIRECTORY_NAME, ["webapps"], true, true).path;
     let dir = FileUtils.getDir(DIRECTORY_NAME, ["webapps", id], true, true);
-    dir.permissions = FileUtils.PERMS_DIRECTORY;
     let manFile = dir.clone();
     manFile.append(manifestName);
     let jsonManifest = aData.isPackage ? app.updateManifest : app.manifest;
@@ -1609,7 +1617,6 @@ this.DOMApplicationRegistry = {
         let zipFile = FileUtils.getFile("TmpD", ["webapps", aId, "application.zip"], true);
         let dir = FileUtils.getDir(DIRECTORY_NAME, ["webapps", aId], true, true);
         zipFile.moveTo(dir, "application.zip");
-        zipFile.permissions = FileUtils.PERMS_FILE;
         let tmpDir = FileUtils.getDir("TmpD", ["webapps", aId], true, true);
         try {
           tmpDir.remove(true);
@@ -1771,6 +1778,7 @@ this.DOMApplicationRegistry = {
 
       let requestChannel = NetUtil.newChannel(aManifest.fullPackagePath())
                                   .QueryInterface(Ci.nsIHttpChannel);
+      requestChannel.loadFlags |= Ci.nsIRequest.INHIBIT_CACHING;
       if (app.packageEtag) {
         debug('Add If-None-Match header: ' + app.packageEtag);
         requestChannel.setRequestHeader("If-None-Match", app.packageEtag, false);
@@ -1857,6 +1865,7 @@ this.DOMApplicationRegistry = {
             // we might do something cleaner to have a proper user error
             debug("We found no ETag Header, canceling the request");
             requestChannel.cancel(Cr.NS_BINDING_ABORTED);
+            AppDownloadManager.remove(aApp.manifestURL);
           }
         },
         onStopRequest: function(aRequest, aContext, aStatusCode) {
@@ -1915,6 +1924,40 @@ this.DOMApplicationRegistry = {
                 zipReader.open(zipFile);
               }
 
+              // XXX Security: You CANNOT safely add a new app store for
+              // installing privileged apps just by modifying this pref and
+              // adding the signing cert for that store to the cert trust
+              // database. *Any* origin listed can install apps signed with
+              // *any* certificate trusted; we don't try to maintain a strong
+              // association between certificate with installOrign. The
+              // expectation here is that in production builds the pref will
+              // contain exactly one origin. However, in custom development
+              // builds it may contain more than one origin so we can test
+              // different stages (dev, staging, prod) of the same app store.
+              //
+              // Only allow signed apps to be installed from a whitelist of
+              // domains, and require all packages installed from any of the
+              // domains on the whitelist to be signed. This is a stopgap until
+              // we have a real story for handling multiple app stores signing
+              // apps.
+              let signedAppOriginsStr =
+                Services.prefs.getCharPref(
+                  "dom.mozApps.signed_apps_installable_from");
+              let isSignedAppOrigin
+                = signedAppOriginsStr.split(",").indexOf(aApp.installOrigin) > -1;
+              if (!isSigned && isSignedAppOrigin) {
+                // Packaged apps installed from these origins must be signed;
+                // if not, assume somebody stripped the signature.
+                throw "INVALID_SIGNATURE";
+              } else if (isSigned && !isSignedAppOrigin) {
+                // Other origins are *prohibited* from installing signed apps.
+                // One reason is that our app revociation mechanism requires
+                // strong cooperation from the host of the mini-manifest, which
+                // we assume to be under the control of the install origin,
+                // even if it has a different origin.
+                throw "INSTALL_FROM_DENIED";
+              }
+
               if (!zipReader.hasEntry("manifest.webapp")) {
                 throw "MISSING_MANIFEST";
               }
@@ -2337,18 +2380,17 @@ this.DOMApplicationRegistry = {
 #elifdef XP_UNIX
     let env = Cc["@mozilla.org/process/environment;1"]
                 .getService(Ci.nsIEnvironment);
-    let xdg_data_home_env = env.get("XDG_DATA_HOME");
+    let xdg_data_home_env;
+    try {
+      xdg_data_home_env = env.get("XDG_DATA_HOME");
+    } catch(ex) {
+    }
 
     let desktopINI;
-    if (xdg_data_home_env != "") {
-      desktopINI = Cc["@mozilla.org/file/local;1"]
-                     .createInstance(Ci.nsIFile);
-      desktopINI.initWithPath(xdg_data_home_env);
-    }
-    else {
-      desktopINI = Services.dirsvc.get("Home", Ci.nsIFile);
-      desktopINI.append(".local");
-      desktopINI.append("share");
+    if (xdg_data_home_env) {
+      desktopINI = new FileUtils.File(xdg_data_home_env);
+    } else {
+      desktopINI = FileUtils.getFile("Home", [".local", "share"]);
     }
     desktopINI.append("applications");
 
diff --git a/dom/audiochannel/AudioChannelAgent.cpp b/dom/audiochannel/AudioChannelAgent.cpp
index 22b0ad940073..1a73b0a66897 100644
--- a/dom/audiochannel/AudioChannelAgent.cpp
+++ b/dom/audiochannel/AudioChannelAgent.cpp
@@ -72,7 +72,7 @@ NS_IMETHODIMP AudioChannelAgent::StartPlaying(bool *_retval)
 
   service->RegisterAudioChannelAgent(this,
     static_cast<AudioChannelType>(mAudioChannelType));
-  *_retval = !service->GetMuted(static_cast<AudioChannelType>(mAudioChannelType), !mVisible);
+  *_retval = !service->GetMuted(this, !mVisible);
   mIsRegToService = true;
   return NS_OK;
 }
@@ -99,8 +99,7 @@ NS_IMETHODIMP AudioChannelAgent::SetVisibilityState(bool visible)
   mVisible = visible;
   if (mIsRegToService && oldVisibility != mVisible && mCallback != nullptr) {
     AudioChannelService *service = AudioChannelService::GetAudioChannelService();
-    mCallback->CanPlayChanged(!service->GetMuted(static_cast<AudioChannelType>(mAudioChannelType),
-       !mVisible));
+    mCallback->CanPlayChanged(!service->GetMuted(this, !mVisible));
   }
   return NS_OK;
 }
@@ -109,8 +108,7 @@ void AudioChannelAgent::NotifyAudioChannelStateChanged()
 {
   if (mCallback != nullptr) {
     AudioChannelService *service = AudioChannelService::GetAudioChannelService();
-    mCallback->CanPlayChanged(!service->GetMuted(static_cast<AudioChannelType>(mAudioChannelType),
-      !mVisible));
+    mCallback->CanPlayChanged(!service->GetMuted(this, !mVisible));
   }
 }
 
diff --git a/dom/audiochannel/AudioChannelService.cpp b/dom/audiochannel/AudioChannelService.cpp
index 342dc0a00eb5..fda246c326b8 100644
--- a/dom/audiochannel/AudioChannelService.cpp
+++ b/dom/audiochannel/AudioChannelService.cpp
@@ -66,7 +66,7 @@ AudioChannelService::Shutdown()
 NS_IMPL_ISUPPORTS0(AudioChannelService)
 
 AudioChannelService::AudioChannelService()
-: mCurrentHigherChannel(AUDIO_CHANNEL_NORMAL)
+: mCurrentHigherChannel(AUDIO_CHANNEL_LAST)
 {
   // Creation of the hash table.
   mAgents.Init();
@@ -87,153 +87,105 @@ void
 AudioChannelService::RegisterAudioChannelAgent(AudioChannelAgent* aAgent,
                                                AudioChannelType aType)
 {
-  mAgents.Put(aAgent, aType);
+  AudioChannelAgentData data = { aType,
+                                 true /* mElementHidden */,
+                                 true /* mMuted */ };
+  mAgents.Put(aAgent, data);
   RegisterType(aType, CONTENT_PARENT_UNKNOWN_CHILD_ID);
 }
 
 void
 AudioChannelService::RegisterType(AudioChannelType aType, uint64_t aChildID)
 {
-  mChannelCounters[aType].AppendElement(aChildID);
+  AudioChannelInternalType type = GetInternalType(aType, true);
+  mChannelCounters[type].AppendElement(aChildID);
 
   // In order to avoid race conditions, it's safer to notify any existing
   // agent any time a new one is registered.
-  Notify();
+  if (XRE_GetProcessType() == GeckoProcessType_Default) {
+    SendAudioChannelChangedNotification();
+    Notify();
+  }
 }
 
 void
 AudioChannelService::UnregisterAudioChannelAgent(AudioChannelAgent* aAgent)
 {
-  AudioChannelType type;
-  if (!mAgents.Get(aAgent, &type)) {
+  AudioChannelAgentData data;
+  if (!mAgents.Get(aAgent, &data)) {
     return;
   }
 
   mAgents.Remove(aAgent);
-  UnregisterType(type, CONTENT_PARENT_UNKNOWN_CHILD_ID);
+  UnregisterType(data.mType, data.mElementHidden, CONTENT_PARENT_UNKNOWN_CHILD_ID);
 }
 
 void
-AudioChannelService::UnregisterType(AudioChannelType aType, uint64_t aChildID)
+AudioChannelService::UnregisterType(AudioChannelType aType,
+                                    bool aElementHidden,
+                                    uint64_t aChildID)
 {
   // The array may contain multiple occurrence of this appId but
   // this should remove only the first one.
-  mChannelCounters[aType].RemoveElement(aChildID);
-
-  bool isNoChannelUsed = true;
-  for (int32_t type = AUDIO_CHANNEL_NORMAL;
-         type <= AUDIO_CHANNEL_PUBLICNOTIFICATION;
-         ++type) {
-    if (!mChannelCounters[type].IsEmpty()) {
-      isNoChannelUsed = false;
-      break;
-    }
-  }
-
-  if (isNoChannelUsed) {
-    nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
-    obs->NotifyObservers(nullptr, "audio-channel-changed", NS_LITERAL_STRING("default").get());
-    mCurrentHigherChannel = AUDIO_CHANNEL_NORMAL;
-    return;
-  }
+  AudioChannelInternalType type = GetInternalType(aType, aElementHidden);
+  mChannelCounters[type].RemoveElement(aChildID);
 
   // In order to avoid race conditions, it's safer to notify any existing
   // agent any time a new one is registered.
-  Notify();
+  if (XRE_GetProcessType() == GeckoProcessType_Default) {
+    SendAudioChannelChangedNotification();
+    Notify();
+  }
 }
 
 bool
-AudioChannelService::GetMuted(AudioChannelType aType, bool aElementHidden)
+AudioChannelService::GetMuted(AudioChannelAgent* aAgent, bool aElementHidden)
 {
-  // We are not visible, maybe we have to mute:
-  if (aElementHidden) {
-    switch (aType) {
-      case AUDIO_CHANNEL_NORMAL:
-        return true;
+  AudioChannelAgentData data;
+  if (!mAgents.Get(aAgent, &data)) {
+    return true;
+  }
 
-      case AUDIO_CHANNEL_CONTENT:
-      {
-        // If we have more than 1 using the content channel,
-        // this must be muted.
-        uint32_t childId = CONTENT_PARENT_UNKNOWN_CHILD_ID;
-        bool empty = true;
-        for (uint32_t i = 0;
-             i < mChannelCounters[AUDIO_CHANNEL_CONTENT].Length();
-             ++i) {
-          if (empty) {
-            childId = mChannelCounters[AUDIO_CHANNEL_CONTENT][i];
-            empty = false;
-          }
-          else if (childId != mChannelCounters[AUDIO_CHANNEL_CONTENT][i])
-            return true;
-        }
-        break;
-      }
+  bool muted = GetMutedInternal(data.mType, CONTENT_PARENT_UNKNOWN_CHILD_ID,
+                                aElementHidden, data.mElementHidden);
 
-      case AUDIO_CHANNEL_NOTIFICATION:
-      case AUDIO_CHANNEL_ALARM:
-      case AUDIO_CHANNEL_TELEPHONY:
-      case AUDIO_CHANNEL_RINGER:
-      case AUDIO_CHANNEL_PUBLICNOTIFICATION:
-        // Nothing to do
-        break;
+  // Update visibility.
+  if (data.mElementHidden != aElementHidden || data.mMuted != muted) {
+    data.mElementHidden = aElementHidden;
+    data.mMuted = muted;
+    mAgents.Put(aAgent, data);
+  }
 
-      case AUDIO_CHANNEL_LAST:
-        MOZ_NOT_REACHED();
-        return false;
-    }
+  SendAudioChannelChangedNotification();
+  return muted;
+}
+
+bool
+AudioChannelService::GetMutedInternal(AudioChannelType aType, uint64_t aChildID,
+                                      bool aElementHidden, bool aElementWasHidden)
+{
+  // Calculating the new and old type and update the hashtable if needed.
+  AudioChannelInternalType newType = GetInternalType(aType, aElementHidden);
+  AudioChannelInternalType oldType = GetInternalType(aType, aElementWasHidden);
+
+  if (newType != oldType) {
+    mChannelCounters[newType].AppendElement(aChildID);
+    mChannelCounters[oldType].RemoveElement(aChildID);
   }
 
   bool muted = false;
 
-  // Priorities:
-  switch (aType) {
-    case AUDIO_CHANNEL_NORMAL:
-    case AUDIO_CHANNEL_CONTENT:
-      muted = !mChannelCounters[AUDIO_CHANNEL_NOTIFICATION].IsEmpty() ||
-              !mChannelCounters[AUDIO_CHANNEL_ALARM].IsEmpty() ||
-              !mChannelCounters[AUDIO_CHANNEL_TELEPHONY].IsEmpty() ||
-              !mChannelCounters[AUDIO_CHANNEL_RINGER].IsEmpty() ||
-              !mChannelCounters[AUDIO_CHANNEL_PUBLICNOTIFICATION].IsEmpty();
-      break;
-
-    case AUDIO_CHANNEL_NOTIFICATION:
-    case AUDIO_CHANNEL_ALARM:
-    case AUDIO_CHANNEL_TELEPHONY:
-    case AUDIO_CHANNEL_RINGER:
-      muted = ChannelsActiveWithHigherPriorityThan(aType);
-      break;
-
-    case AUDIO_CHANNEL_PUBLICNOTIFICATION:
-      break;
-
-    case AUDIO_CHANNEL_LAST:
-      MOZ_NOT_REACHED();
-      return false;
+  // We are not visible, maybe we have to mute.
+  if (newType == AUDIO_CHANNEL_INT_NORMAL_HIDDEN ||
+      (newType == AUDIO_CHANNEL_INT_CONTENT_HIDDEN &&
+       (!mChannelCounters[AUDIO_CHANNEL_INT_CONTENT].IsEmpty() ||
+        HasMoreThanOneContentChannelHidden()))) {
+    muted = true;
   }
 
-  // Notification if needed.
   if (!muted) {
-
-    // Calculating the most important unmuted channel:
-    AudioChannelType higher = AUDIO_CHANNEL_NORMAL;
-    for (int32_t type = AUDIO_CHANNEL_NORMAL;
-         type <= AUDIO_CHANNEL_PUBLICNOTIFICATION;
-         ++type) {
-      if (!mChannelCounters[type].IsEmpty()) {
-        higher = (AudioChannelType)type;
-      }
-    }
-
-    if (higher != mCurrentHigherChannel) {
-      mCurrentHigherChannel = higher;
-
-      nsString channelName;
-      channelName.AssignASCII(ChannelName(mCurrentHigherChannel));
-
-      nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
-      obs->NotifyObservers(nullptr, "audio-channel-changed", channelName.get());
-    }
+    MOZ_ASSERT(newType != AUDIO_CHANNEL_INT_NORMAL_HIDDEN);
+    muted = ChannelsActiveWithHigherPriorityThan(newType);
   }
 
   return muted;
@@ -242,16 +194,93 @@ AudioChannelService::GetMuted(AudioChannelType aType, bool aElementHidden)
 bool
 AudioChannelService::ContentChannelIsActive()
 {
-  return mChannelCounters[AUDIO_CHANNEL_CONTENT].Length() > 0;
+  return !mChannelCounters[AUDIO_CHANNEL_INT_CONTENT].IsEmpty() ||
+         !mChannelCounters[AUDIO_CHANNEL_INT_CONTENT_HIDDEN].IsEmpty();
 }
 
-static PLDHashOperator
-NotifyEnumerator(AudioChannelAgent* aAgent,
-                 AudioChannelType aType, void* aData)
+bool
+AudioChannelService::HasMoreThanOneContentChannelHidden()
 {
-  if (aAgent) {
-    aAgent->NotifyAudioChannelStateChanged();
+  uint32_t childId = CONTENT_PARENT_UNKNOWN_CHILD_ID;
+  bool empty = true;
+  for (uint32_t i = 0;
+       i < mChannelCounters[AUDIO_CHANNEL_INT_CONTENT_HIDDEN].Length();
+       ++i) {
+    if (empty) {
+      childId = mChannelCounters[AUDIO_CHANNEL_INT_CONTENT_HIDDEN][i];
+      empty = false;
+    } else if (childId != mChannelCounters[AUDIO_CHANNEL_INT_CONTENT_HIDDEN][i]) {
+      return true;
+    }
   }
+
+  return false;
+}
+
+void
+AudioChannelService::SendAudioChannelChangedNotification()
+{
+  if (XRE_GetProcessType() != GeckoProcessType_Default) {
+    return;
+  }
+
+  // Calculating the most important active channel.
+  AudioChannelType higher = AUDIO_CHANNEL_LAST;
+
+  // Top-Down in the hierarchy.
+  if (!mChannelCounters[AUDIO_CHANNEL_INT_PUBLICNOTIFICATION].IsEmpty()) {
+    higher = AUDIO_CHANNEL_PUBLICNOTIFICATION;
+  }
+
+  else if (!mChannelCounters[AUDIO_CHANNEL_INT_RINGER].IsEmpty()) {
+    higher = AUDIO_CHANNEL_RINGER;
+  }
+
+  else if (!mChannelCounters[AUDIO_CHANNEL_INT_TELEPHONY].IsEmpty()) {
+    higher = AUDIO_CHANNEL_TELEPHONY;
+  }
+
+  else if (!mChannelCounters[AUDIO_CHANNEL_INT_ALARM].IsEmpty()) {
+    higher = AUDIO_CHANNEL_ALARM;
+  }
+
+  else if (!mChannelCounters[AUDIO_CHANNEL_INT_NOTIFICATION].IsEmpty()) {
+    higher = AUDIO_CHANNEL_NOTIFICATION;
+  }
+
+  // Only 1 content channel hidden or a visible one.
+  else if ((!mChannelCounters[AUDIO_CHANNEL_INT_CONTENT_HIDDEN].IsEmpty() &&
+            !HasMoreThanOneContentChannelHidden()) ||
+           !mChannelCounters[AUDIO_CHANNEL_INT_CONTENT].IsEmpty()) {
+    higher = AUDIO_CHANNEL_CONTENT;
+  }
+
+  // At least 1 visible normal channel.
+  else if (!mChannelCounters[AUDIO_CHANNEL_INT_NORMAL].IsEmpty()) {
+    higher = AUDIO_CHANNEL_NORMAL;
+  }
+
+  if (higher != mCurrentHigherChannel) {
+    mCurrentHigherChannel = higher;
+
+    nsString channelName;
+    if (mCurrentHigherChannel != AUDIO_CHANNEL_LAST) {
+      channelName.AssignASCII(ChannelName(mCurrentHigherChannel));
+    } else {
+      channelName.AssignLiteral("none");
+    }
+
+    nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
+    obs->NotifyObservers(nullptr, "audio-channel-changed", channelName.get());
+  }
+}
+
+PLDHashOperator
+AudioChannelService::NotifyEnumerator(AudioChannelAgent* aAgent,
+                                      AudioChannelAgentData aData, void* aUnused)
+{
+  MOZ_ASSERT(aAgent);
+  aAgent->NotifyAudioChannelStateChanged();
   return PL_DHASH_NEXT;
 }
 
@@ -272,10 +301,10 @@ AudioChannelService::Notify()
 }
 
 bool
-AudioChannelService::ChannelsActiveWithHigherPriorityThan(AudioChannelType aType)
+AudioChannelService::ChannelsActiveWithHigherPriorityThan(AudioChannelInternalType aType)
 {
-  for (int i = AUDIO_CHANNEL_PUBLICNOTIFICATION;
-       i != AUDIO_CHANNEL_CONTENT; --i) {
+  for (int i = AUDIO_CHANNEL_INT_PUBLICNOTIFICATION;
+       i != AUDIO_CHANNEL_INT_CONTENT_HIDDEN; --i) {
     if (i == aType) {
       return false;
     }
@@ -331,8 +360,8 @@ AudioChannelService::Observe(nsISupports* aSubject, const char* aTopic, const PR
   nsresult rv = props->GetPropertyAsUint64(NS_LITERAL_STRING("childID"),
                                            &childID);
   if (NS_SUCCEEDED(rv)) {
-    for (int32_t type = AUDIO_CHANNEL_NORMAL;
-         type <= AUDIO_CHANNEL_PUBLICNOTIFICATION;
+    for (int32_t type = AUDIO_CHANNEL_INT_NORMAL;
+         type < AUDIO_CHANNEL_INT_LAST;
          ++type) {
       int32_t index;
       while ((index = mChannelCounters[type].IndexOf(childID)) != -1) {
@@ -343,6 +372,7 @@ AudioChannelService::Observe(nsISupports* aSubject, const char* aTopic, const PR
     // We don't have to remove the agents from the mAgents hashtable because if
     // that table contains only agents running on the same process.
 
+    SendAudioChannelChangedNotification();
     Notify();
   } else {
     NS_WARNING("ipc:content-shutdown message without childID property");
@@ -350,3 +380,40 @@ AudioChannelService::Observe(nsISupports* aSubject, const char* aTopic, const PR
 
   return NS_OK;
 }
+
+AudioChannelService::AudioChannelInternalType
+AudioChannelService::GetInternalType(AudioChannelType aType,
+                                     bool aElementHidden)
+{
+  switch (aType) {
+    case AUDIO_CHANNEL_NORMAL:
+      return aElementHidden
+               ? AUDIO_CHANNEL_INT_NORMAL_HIDDEN : AUDIO_CHANNEL_INT_NORMAL;
+
+    case AUDIO_CHANNEL_CONTENT:
+      return aElementHidden
+               ? AUDIO_CHANNEL_INT_CONTENT_HIDDEN : AUDIO_CHANNEL_INT_CONTENT;
+
+    case AUDIO_CHANNEL_NOTIFICATION:
+      return AUDIO_CHANNEL_INT_NOTIFICATION;
+
+    case AUDIO_CHANNEL_ALARM:
+      return AUDIO_CHANNEL_INT_ALARM;
+
+    case AUDIO_CHANNEL_TELEPHONY:
+      return AUDIO_CHANNEL_INT_TELEPHONY;
+
+    case AUDIO_CHANNEL_RINGER:
+      return AUDIO_CHANNEL_INT_RINGER;
+
+    case AUDIO_CHANNEL_PUBLICNOTIFICATION:
+      return AUDIO_CHANNEL_INT_PUBLICNOTIFICATION;
+
+    case AUDIO_CHANNEL_LAST:
+    default:
+      break;
+  }
+
+  MOZ_NOT_REACHED();
+  return AUDIO_CHANNEL_INT_LAST;
+}
diff --git a/dom/audiochannel/AudioChannelService.h b/dom/audiochannel/AudioChannelService.h
index 096fcb36b2cc..7cb1a1cfdc14 100644
--- a/dom/audiochannel/AudioChannelService.h
+++ b/dom/audiochannel/AudioChannelService.h
@@ -51,7 +51,7 @@ public:
   /**
    * Return true if this type should be muted.
    */
-  virtual bool GetMuted(AudioChannelType aType, bool aElementHidden);
+  virtual bool GetMuted(AudioChannelAgent* aAgent, bool aElementHidden);
 
   /**
    * Return true if there is a content channel active in this process
@@ -62,20 +62,57 @@ public:
 protected:
   void Notify();
 
+  /**
+   * Send the audio-channel-changed notification if needed.
+   */
+  void SendAudioChannelChangedNotification();
+
   /* Register/Unregister IPC types: */
   void RegisterType(AudioChannelType aType, uint64_t aChildID);
-  void UnregisterType(AudioChannelType aType, uint64_t aChildID);
+  void UnregisterType(AudioChannelType aType, bool aElementHidden,
+                      uint64_t aChildID);
+
+  bool GetMutedInternal(AudioChannelType aType, uint64_t aChildID,
+                        bool aElementHidden, bool aElementWasHidden);
 
   AudioChannelService();
   virtual ~AudioChannelService();
 
-  bool ChannelsActiveWithHigherPriorityThan(AudioChannelType aType);
+  enum AudioChannelInternalType {
+    AUDIO_CHANNEL_INT_NORMAL = 0,
+    AUDIO_CHANNEL_INT_NORMAL_HIDDEN,
+    AUDIO_CHANNEL_INT_CONTENT,
+    AUDIO_CHANNEL_INT_CONTENT_HIDDEN,
+    AUDIO_CHANNEL_INT_NOTIFICATION,
+    AUDIO_CHANNEL_INT_ALARM,
+    AUDIO_CHANNEL_INT_TELEPHONY,
+    AUDIO_CHANNEL_INT_RINGER,
+    AUDIO_CHANNEL_INT_PUBLICNOTIFICATION,
+    AUDIO_CHANNEL_INT_LAST
+  };
+
+  bool ChannelsActiveWithHigherPriorityThan(AudioChannelInternalType aType);
+
+  bool HasMoreThanOneContentChannelHidden();
 
   const char* ChannelName(AudioChannelType aType);
 
-  nsDataHashtable< nsPtrHashKey<AudioChannelAgent>, AudioChannelType > mAgents;
+  AudioChannelInternalType GetInternalType(AudioChannelType aType,
+                                           bool aElementHidden);
 
-  nsTArray<uint64_t> mChannelCounters[AUDIO_CHANNEL_PUBLICNOTIFICATION+1];
+  struct AudioChannelAgentData {
+    AudioChannelType mType;
+    bool mElementHidden;
+    bool mMuted;
+  };
+
+  static PLDHashOperator
+  NotifyEnumerator(AudioChannelAgent* aAgent,
+                   AudioChannelAgentData aData, void *aUnused);
+
+  nsDataHashtable< nsPtrHashKey<AudioChannelAgent>, AudioChannelAgentData > mAgents;
+
+  nsTArray<uint64_t> mChannelCounters[AUDIO_CHANNEL_INT_LAST];
 
   AudioChannelType mCurrentHigherChannel;
 
diff --git a/dom/audiochannel/AudioChannelServiceChild.cpp b/dom/audiochannel/AudioChannelServiceChild.cpp
index c5ec949d66f8..f884c77f785b 100644
--- a/dom/audiochannel/AudioChannelServiceChild.cpp
+++ b/dom/audiochannel/AudioChannelServiceChild.cpp
@@ -57,13 +57,29 @@ AudioChannelServiceChild::~AudioChannelServiceChild()
 }
 
 bool
-AudioChannelServiceChild::GetMuted(AudioChannelType aType, bool aMozHidden)
+AudioChannelServiceChild::GetMuted(AudioChannelAgent* aAgent, bool aElementHidden)
 {
+  AudioChannelAgentData data;
+  if (!mAgents.Get(aAgent, &data)) {
+    return true;
+  }
+
   ContentChild *cc = ContentChild::GetSingleton();
-  bool muted = false;
+  bool muted = true;
 
   if (cc) {
-    cc->SendAudioChannelGetMuted(aType, aMozHidden, &muted);
+    cc->SendAudioChannelGetMuted(data.mType, aElementHidden, data.mElementHidden, &muted);
+  }
+
+  // Update visibility.
+  if (data.mElementHidden != aElementHidden || data.mMuted != muted) {
+    data.mElementHidden = aElementHidden;
+    data.mMuted = muted;
+    mAgents.Put(aAgent, data);
+  }
+
+  if (cc) {
+    cc->SendAudioChannelChangedNotification();
   }
 
   return muted;
@@ -89,8 +105,8 @@ AudioChannelServiceChild::RegisterAudioChannelAgent(AudioChannelAgent* aAgent,
 void
 AudioChannelServiceChild::UnregisterAudioChannelAgent(AudioChannelAgent* aAgent)
 {
-  AudioChannelType type;
-  if (!mAgents.Get(aAgent, &type)) {
+  AudioChannelAgentData data;
+  if (!mAgents.Get(aAgent, &data)) {
     return;
   }
 
@@ -98,7 +114,7 @@ AudioChannelServiceChild::UnregisterAudioChannelAgent(AudioChannelAgent* aAgent)
 
   ContentChild *cc = ContentChild::GetSingleton();
   if (cc) {
-    cc->SendAudioChannelUnregisterType(type);
+    cc->SendAudioChannelUnregisterType(data.mType, data.mElementHidden);
   }
 
   nsCOMPtr<nsIObserverService> obs = mozilla::services::GetObserverService();
diff --git a/dom/audiochannel/AudioChannelServiceChild.h b/dom/audiochannel/AudioChannelServiceChild.h
index 6af93245d62c..1cd23f7fd420 100644
--- a/dom/audiochannel/AudioChannelServiceChild.h
+++ b/dom/audiochannel/AudioChannelServiceChild.h
@@ -36,7 +36,7 @@ public:
   /**
    * Return true if this type + this mozHidden should be muted.
    */
-  virtual bool GetMuted(AudioChannelType aType, bool aMozHidden);
+  virtual bool GetMuted(AudioChannelAgent* aAgent, bool aMozHidden);
 
 protected:
   AudioChannelServiceChild();
diff --git a/dom/base/nsDOMClassInfo.cpp b/dom/base/nsDOMClassInfo.cpp
index fb612c6a362f..d59b4928fb4f 100644
--- a/dom/base/nsDOMClassInfo.cpp
+++ b/dom/base/nsDOMClassInfo.cpp
@@ -3279,7 +3279,6 @@ nsDOMClassInfo::Init()
   DOM_CLASSINFO_MAP_BEGIN(SVGLinearGradientElement, nsIDOMSVGLinearGradientElement)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGGradientElement)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGLinearGradientElement)
-    DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGTests)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGURIReference)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGUnitTypes)
     DOM_CLASSINFO_SVG_ELEMENT_MAP_ENTRIES
@@ -3336,7 +3335,6 @@ nsDOMClassInfo::Init()
   DOM_CLASSINFO_MAP_BEGIN(SVGRadialGradientElement, nsIDOMSVGRadialGradientElement)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGGradientElement)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGRadialGradientElement)
-    DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGTests)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGURIReference)
     DOM_CLASSINFO_MAP_ENTRY(nsIDOMSVGUnitTypes)
     DOM_CLASSINFO_SVG_ELEMENT_MAP_ENTRIES
@@ -3810,7 +3808,7 @@ nsDOMClassInfo::Init()
   DOM_CLASSINFO_MAP_END
 
   DOM_CLASSINFO_MAP_BEGIN_NO_CLASS_IF(ChromeMessageSender, nsISupports)
-    DOM_CLASSINFO_MAP_ENTRY(nsIPermissionChecker)
+    DOM_CLASSINFO_MAP_ENTRY(nsIProcessChecker)
     DOM_CLASSINFO_MAP_ENTRY(nsIFrameScriptLoader)
     DOM_CLASSINFO_MAP_ENTRY(nsIMessageListenerManager)
     DOM_CLASSINFO_MAP_ENTRY(nsIMessageSender)
diff --git a/dom/base/nsGlobalWindow.cpp b/dom/base/nsGlobalWindow.cpp
index 47fc35398988..1b36c13f34da 100644
--- a/dom/base/nsGlobalWindow.cpp
+++ b/dom/base/nsGlobalWindow.cpp
@@ -741,7 +741,8 @@ nsGlobalWindow::nsGlobalWindow(nsGlobalWindow *aOuterWindow)
   if (!PR_GetEnv("MOZ_QUIET")) {
     printf("++DOMWINDOW == %d (%p) [serial = %d] [outer = %p]\n", gRefCnt,
            static_cast<void*>(static_cast<nsIScriptGlobalObject*>(this)),
-           gSerialCounter, static_cast<void*>(aOuterWindow));
+           gSerialCounter,
+           static_cast<void*>(static_cast<nsIScriptGlobalObject*>(aOuterWindow)));
   }
 #endif
 
@@ -816,9 +817,10 @@ nsGlobalWindow::~nsGlobalWindow()
       }
     }
 
+    nsGlobalWindow* outer = static_cast<nsGlobalWindow*>(mOuterWindow.get());
     printf("--DOMWINDOW == %d (%p) [serial = %d] [outer = %p] [url = %s]\n",
            gRefCnt, static_cast<void*>(static_cast<nsIScriptGlobalObject*>(this)),
-           mSerial, static_cast<void*>(mOuterWindow.get()), url.get());
+           mSerial, static_cast<void*>(static_cast<nsIScriptGlobalObject*>(outer)), url.get());
   }
 #endif
 
diff --git a/dom/base/nsJSEnvironment.cpp b/dom/base/nsJSEnvironment.cpp
index 07d121e7a075..849ae739d88c 100644
--- a/dom/base/nsJSEnvironment.cpp
+++ b/dom/base/nsJSEnvironment.cpp
@@ -3308,6 +3308,12 @@ CCTimerFired(nsITimer *aTimer, void *aClosure)
 
     PRTime now = PR_Now();
     if (sCCLockedOutTime == 0) {
+      // Reset sCCTimerFireCount so that we run forgetSkippable
+      // often enough before CC. Because of reduced ccDelay
+      // forgetSkippable will be called just a few times.
+      // NS_MAX_CC_LOCKEDOUT_TIME limit guarantees that we end up calling
+      // forgetSkippable and CycleCollectNow eventually.
+      sCCTimerFireCount = 0;
       sCCLockedOutTime = now;
       return;
     }
diff --git a/dom/bindings/Bindings.conf b/dom/bindings/Bindings.conf
index bceef72a6f6c..b22c72591c98 100644
--- a/dom/bindings/Bindings.conf
+++ b/dom/bindings/Bindings.conf
@@ -142,9 +142,12 @@ DOMInterfaces = {
     'nativeType': 'nsDOMCaretPosition',                                        
 },                                                                             
 
+'CDATASection': {
+    'hasInstanceInterface': 'nsIDOMCDATASection',
+},
+
 'CharacterData': {
     'nativeType': 'nsGenericDOMDataNode',
-    'hasXPConnectImpls': True,
     'hasInstanceInterface': 'nsIDOMCharacterData',
     'concrete': False
 },
@@ -562,6 +565,10 @@ DOMInterfaces = {
     'headerFile': 'nsPerformance.h'
 },
 
+'ProcessingInstruction': {
+    'hasInstanceInterface': 'nsIDOMProcessingInstruction',
+},
+
 'PropertyNodeList': {
     'headerFile': 'HTMLPropertiesCollection.h',
     'resultNotAddRefed': [ 'item' ]
@@ -1161,7 +1168,6 @@ addExternalHTMLElement('HTMLVideoElement')
 addExternalIface('Attr')
 addExternalIface('CanvasGradient', headerFile='nsIDOMCanvasRenderingContext2D.h')
 addExternalIface('CanvasPattern', headerFile='nsIDOMCanvasRenderingContext2D.h')
-addExternalIface('CDATASection')
 addExternalIface('ClientRect')
 addExternalIface("Counter")
 addExternalIface('CSSRule')
@@ -1183,7 +1189,6 @@ addExternalIface('OutputStream', nativeType='nsIOutputStream',
                  notflattened=True)
 addExternalIface('Principal', nativeType='nsIPrincipal',
                  headerFile='nsIPrincipal.h', notflattened=True)
-addExternalIface('ProcessingInstruction', nativeType='nsXMLProcessingInstruction')
 addExternalIface('Range', nativeType='nsRange')
 addExternalIface('Selection', nativeType='nsISelection')
 addExternalIface('StyleSheetList')
diff --git a/dom/bindings/Codegen.py b/dom/bindings/Codegen.py
index ebbd58208368..c3b32e536e4e 100644
--- a/dom/bindings/Codegen.py
+++ b/dom/bindings/Codegen.py
@@ -6648,8 +6648,8 @@ class CGDictionary(CGThing):
              "  }\n" if self.needToInitIds else "") +
             "${initParent}" +
             ("  JSBool found;\n"
-             "  JS::Value temp;\n" if len(memberInits) > 0 else "") +
-            "  bool isNull = val.isNullOrUndefined();\n"
+             "  JS::Value temp;\n"
+             "  bool isNull = val.isNullOrUndefined();\n" if len(memberInits) > 0 else "") +
             "  if (!IsConvertibleToDictionary(cx, val)) {\n"
             "    return ThrowErrorMessage(cx, MSG_NOT_DICTIONARY);\n"
             "  }\n"
diff --git a/dom/bluetooth/BluetoothHfpManager.cpp b/dom/bluetooth/BluetoothHfpManager.cpp
index b004cb0ad2fe..ee6a41ce63b0 100644
--- a/dom/bluetooth/BluetoothHfpManager.cpp
+++ b/dom/bluetooth/BluetoothHfpManager.cpp
@@ -4,7 +4,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "base/basictypes.h" 
+#include "base/basictypes.h"
 
 #include "BluetoothHfpManager.h"
 
@@ -25,8 +25,6 @@
 #include "nsIRadioInterfaceLayer.h"
 #include "nsRadioInterfaceLayer.h"
 
-#include <unistd.h> /* usleep() */
-
 #define AUDIO_VOLUME_BT_SCO "audio.volume.bt_sco"
 #define MOZSETTINGS_CHANGED_ID "mozsettings-changed"
 #define MOBILE_CONNECTION_ICCINFO_CHANGED "mobile-connection-iccinfo-changed"
@@ -302,6 +300,19 @@ CloseScoSocket()
   sco->Disconnect();
 }
 
+bool
+IsValidDtmf(const char aChar) {
+  // Valid DTMF: [*#0-9ABCD]
+  if (aChar == '*' || aChar == '#') {
+    return true;
+  } else if (aChar >= '0' && aChar <= '9') {
+    return true;
+  } else if (aChar >= 'A' && aChar <= 'D') {
+    return true;
+  }
+  return false;
+}
+
 BluetoothHfpManager::BluetoothHfpManager()
   : mCurrentCallIndex(0)
   , mReceiveVgsFlag(false)
@@ -616,6 +627,33 @@ BluetoothHfpManager::ReceiveSocketData(UnixSocketRawData* aMessage)
      * SLC establishment is done when AT+CMER has been received.
      * Do nothing but respond with "OK".
      */
+    ParseAtCommand(msg, 8, atCommandValues);
+
+    if (atCommandValues.Length() <= 4) {
+      NS_WARNING("Could't get the value of command [AT+CMER=]");
+      goto respond_with_ok;
+    }
+
+    if (!atCommandValues[0].EqualsLiteral("3") ||
+        !atCommandValues[1].EqualsLiteral("0") ||
+        !atCommandValues[2].EqualsLiteral("0")) {
+      NS_WARNING("Wrong value of CMER");
+      goto respond_with_ok;
+    }
+
+    mCMER = (atCommandValues[3].EqualsLiteral("1"));
+  } else if (msg.Find("AT+VTS=") != -1) {
+    ParseAtCommand(msg, 7, atCommandValues);
+    if (atCommandValues.Length() != 1) {
+      NS_WARNING("Couldn't get the value of command [AT+VTS=]");
+      goto respond_with_ok;
+    }
+
+    if (IsValidDtmf(atCommandValues[0].get()[0])) {
+      nsAutoCString message("VTS=");
+      message += atCommandValues[0].get()[0];
+      NotifyDialer(NS_ConvertUTF8toUTF16(message));
+    }
   } else if (msg.Find("AT+VGM=") != -1) {
     ParseAtCommand(msg, 7, atCommandValues);
 
@@ -877,6 +915,11 @@ BluetoothHfpManager::SendCommand(const char* aCommand, const int aValue)
   message += aCommand;
 
   if (!strcmp(aCommand, "+CIEV: ")) {
+    if (!mCMER) {
+      // Indicator status update is disabled
+      return true;
+    }
+
     if ((aValue < 1) || (aValue > ArrayLength(sCINDItems) - 1)) {
       NS_WARNING("unexpected CINDType for CIEV command");
       return false;
@@ -940,8 +983,10 @@ BluetoothHfpManager::SetupCIND(int aCallIndex, int aCallState,
         sStopSendingRingFlag = false;
 
         if (!mCLIP) {
-          MessageLoop::current()->PostTask(FROM_HERE,
-                                           new SendRingIndicatorTask(""));
+          MessageLoop::current()->
+            PostDelayedTask(FROM_HERE,
+                            new SendRingIndicatorTask(""),
+                            sRingInterval);
         } else {
           // Same logic as implementation in ril_worker.js
           int type = TOA_UNKNOWN;
@@ -950,8 +995,10 @@ BluetoothHfpManager::SetupCIND(int aCallIndex, int aCallState,
             type = TOA_INTERNATIONAL;
           }
 
-          MessageLoop::current()->PostTask(FROM_HERE,
-                                           new SendRingIndicatorTask(aNumber, type));
+          MessageLoop::current()->
+            PostDelayedTask(FROM_HERE,
+                            new SendRingIndicatorTask(aNumber, type),
+                            sRingInterval);
         }
       }
       break;
@@ -1057,7 +1104,7 @@ BluetoothHfpManager::SetupCIND(int aCallIndex, int aCallState,
       if (!aInitial) {
         SendCommand("+CIEV: ", CINDType::CALLHELD);
       }
-      
+
       break;
     default:
 #ifdef DEBUG
@@ -1167,4 +1214,5 @@ BluetoothHfpManager::OnDisconnect()
   sCINDItems[CINDType::CALLSETUP].value = CallSetupState::NO_CALLSETUP;
   sCINDItems[CINDType::CALLHELD].value = CallHeldState::NO_CALLHELD;
   mCLIP = false;
+  mCMER = false;
 }
diff --git a/dom/bluetooth/BluetoothHfpManager.h b/dom/bluetooth/BluetoothHfpManager.h
index acf3b19cc4a2..2354bdae6e94 100644
--- a/dom/bluetooth/BluetoothHfpManager.h
+++ b/dom/bluetooth/BluetoothHfpManager.h
@@ -59,6 +59,7 @@ private:
   int mCurrentVgm;
   int mCurrentCallIndex;
   bool mCLIP;
+  bool mCMER;
   bool mReceiveVgsFlag;
   nsString mDevicePath;
   nsString mMsisdn;
diff --git a/dom/bluetooth/BluetoothOppManager.cpp b/dom/bluetooth/BluetoothOppManager.cpp
index 5ac296206167..85dc56aaa80f 100644
--- a/dom/bluetooth/BluetoothOppManager.cpp
+++ b/dom/bluetooth/BluetoothOppManager.cpp
@@ -1010,6 +1010,12 @@ BluetoothOppManager::SendAbortRequest()
   SendSocketData(s);
 }
 
+bool
+BluetoothOppManager::IsTransferring()
+{
+  return (mConnected && !mSendTransferCompleteFlag);
+}
+
 void
 BluetoothOppManager::ReplyToConnect()
 {
diff --git a/dom/bluetooth/BluetoothOppManager.h b/dom/bluetooth/BluetoothOppManager.h
index b50e7d65d6a7..2654009059fd 100644
--- a/dom/bluetooth/BluetoothOppManager.h
+++ b/dom/bluetooth/BluetoothOppManager.h
@@ -68,6 +68,10 @@ public:
   void ExtractPacketHeaders(const ObexHeaderSet& aHeader);
   bool ExtractBlobHeaders();
   nsresult HandleShutdown();
+
+  // Return true if there is an ongoing file-transfer session, please see
+  // Bug 827267 for more information.
+  bool IsTransferring();
 private:
   BluetoothOppManager();
   void StartFileTransfer();
diff --git a/dom/bluetooth/linux/BluetoothDBusService.cpp b/dom/bluetooth/linux/BluetoothDBusService.cpp
index 004f09d8c9fa..8134db4a97ef 100644
--- a/dom/bluetooth/linux/BluetoothDBusService.cpp
+++ b/dom/bluetooth/linux/BluetoothDBusService.cpp
@@ -2497,7 +2497,7 @@ BluetoothDBusService::IsConnected(const uint16_t aProfileId)
     return hfp->GetConnectionStatus() == SocketConnectionStatus::SOCKET_CONNECTED;
   } else if (aProfileId == BluetoothServiceClass::OBJECT_PUSH) {
     BluetoothOppManager* opp = BluetoothOppManager::Get();
-    return opp->GetConnectionStatus() == SocketConnectionStatus::SOCKET_CONNECTED;
+    return opp->IsTransferring();
   }
 
   return false;
diff --git a/dom/browser-element/BrowserElementChild.js b/dom/browser-element/BrowserElementChild.js
index 400379cffc42..fddb9e7e4fe8 100644
--- a/dom/browser-element/BrowserElementChild.js
+++ b/dom/browser-element/BrowserElementChild.js
@@ -124,6 +124,7 @@ BrowserElementChild.prototype = {
     addMsgListener("purge-history", this._recvPurgeHistory);
     addMsgListener("get-screenshot", this._recvGetScreenshot);
     addMsgListener("set-visible", this._recvSetVisible);
+    addMsgListener("get-visible", this._recvVisible);
     addMsgListener("send-mouse-event", this._recvSendMouseEvent);
     addMsgListener("send-touch-event", this._recvSendTouchEvent);
     addMsgListener("get-can-go-back", this._recvCanGoBack);
@@ -617,6 +618,13 @@ BrowserElementChild.prototype = {
     this._updateDocShellVisibility();
   },
 
+  _recvVisible: function(data) {
+    sendAsyncMsg('got-visible', {
+      id: data.json.id,
+      successRv: docShell.isActive
+    });
+  },
+
   /**
    * Called when the window which contains this iframe becomes hidden or
    * visible.
diff --git a/dom/browser-element/BrowserElementParent.js b/dom/browser-element/BrowserElementParent.js
index c8a79ff1c85e..f819bcdc10f2 100644
--- a/dom/browser-element/BrowserElementParent.js
+++ b/dom/browser-element/BrowserElementParent.js
@@ -224,6 +224,7 @@ function BrowserElementParent(frameLoader, hasRemoteFrame) {
   addMessageListener('fullscreen-origin-change', this._remoteFullscreenOriginChange);
   addMessageListener('rollback-fullscreen', this._remoteFrameFullscreenReverted);
   addMessageListener('exit-fullscreen', this._exitFullscreen);
+  addMessageListener('got-visible', this._gotDOMRequestResult);
 
   let os = Cc["@mozilla.org/observer-service;1"].getService(Ci.nsIObserverService);
   os.addObserver(this, 'ask-children-to-exit-fullscreen', /* ownsWeak = */ true);
@@ -247,6 +248,7 @@ function BrowserElementParent(frameLoader, hasRemoteFrame) {
 
   // Define methods on the frame element.
   defineMethod('setVisible', this._setVisible);
+  defineDOMRequestMethod('getVisible', 'get-visible');
   defineMethod('sendMouseEvent', this._sendMouseEvent);
 
   // 0 = disabled, 1 = enabled, 2 - auto detect
diff --git a/dom/browser-element/mochitest/browserElement_SetVisible.js b/dom/browser-element/mochitest/browserElement_SetVisible.js
index ddcaa492d25f..3c207176ad6f 100644
--- a/dom/browser-element/mochitest/browserElement_SetVisible.js
+++ b/dom/browser-element/mochitest/browserElement_SetVisible.js
@@ -48,6 +48,23 @@ function runTest() {
   }
 
   function iframeLoaded() {
+    testGetVisible();
+  }
+
+  function testGetVisible() {
+    iframe1.setVisible(false);
+    iframe1.getVisible().onsuccess = function(evt) {
+      ok(evt.target.result === false, 'getVisible() responds false after setVisible(false)');
+
+      iframe1.setVisible(true);
+      iframe1.getVisible().onsuccess = function(evt) {
+        ok(evt.target.result === true, 'getVisible() responds true after setVisible(true)');
+        testVisibilityChanges();
+      };
+    };
+  }
+
+  function testVisibilityChanges() {
     mm = SpecialPowers.getBrowserFrameMessageManager(iframe1);
     mm.addMessageListener('test:visibilitychange', recvVisibilityChanged);
     mm.loadFrameScript('data:,(' + iframeScript.toString() + ')();', false);
diff --git a/dom/browser-element/mochitest/browserElement_SetVisibleFrames.js b/dom/browser-element/mochitest/browserElement_SetVisibleFrames.js
index e5a36d2b7df2..0c1d0c8cd49a 100644
--- a/dom/browser-element/mochitest/browserElement_SetVisibleFrames.js
+++ b/dom/browser-element/mochitest/browserElement_SetVisibleFrames.js
@@ -44,15 +44,29 @@ function runTest() {
 }
 
 function test1() {
-  expectMessage('child1:hidden', test2);
+  expectMessage('child1:hidden', getVisibleTest1);
   iframe.setVisible(false);
 }
 
+function getVisibleTest1() {
+  iframe.getVisible().onsuccess = function(evt) {
+    ok(evt.target.result === false, 'getVisible shows a hidden frame');
+    test2();
+  };
+}
+
 function test2() {
-  expectMessage('child1:visible', finish);
+  expectMessage('child1:visible', getVisibleTest2);
   iframe.setVisible(true);
 }
 
+function getVisibleTest2() {
+  iframe.getVisible().onsuccess = function(evt) {
+    ok(evt.target.result === true, 'getVisible shows a displayed frame');
+    finish();
+  };
+}
+
 function finish() {
   // We need to remove this listener because when this test finishes and the
   // iframe containing this document is navigated, we'll fire a
diff --git a/dom/camera/CameraControlImpl.cpp b/dom/camera/CameraControlImpl.cpp
index fa1de41c86dd..7a266ed5b97f 100644
--- a/dom/camera/CameraControlImpl.cpp
+++ b/dom/camera/CameraControlImpl.cpp
@@ -196,7 +196,7 @@ CameraControlImpl::Get(JSContext* aCx, uint32_t aKey, JS::Value* aValue)
 nsresult
 CameraControlImpl::Set(nsICameraShutterCallback* aOnShutter)
 {
-  mOnShutterCb = aOnShutter;
+  mOnShutterCb = new nsMainThreadPtrHolder<nsICameraShutterCallback>(aOnShutter);
   return NS_OK;
 }
 
@@ -210,7 +210,7 @@ CameraControlImpl::Get(nsICameraShutterCallback** aOnShutter)
 nsresult
 CameraControlImpl::Set(nsICameraClosedCallback* aOnClosed)
 {
-  mOnClosedCb = aOnClosed;
+  mOnClosedCb = new nsMainThreadPtrHolder<nsICameraClosedCallback>(aOnClosed);
   return NS_OK;
 }
 
@@ -224,7 +224,7 @@ CameraControlImpl::Get(nsICameraClosedCallback** aOnClosed)
 nsresult
 CameraControlImpl::Set(nsICameraRecorderStateChange* aOnRecorderStateChange)
 {
-  mOnRecorderStateChangeCb = aOnRecorderStateChange;
+  mOnRecorderStateChangeCb = new nsMainThreadPtrHolder<nsICameraRecorderStateChange>(aOnRecorderStateChange);
   return NS_OK;
 }
 
@@ -258,7 +258,7 @@ void
 CameraControlImpl::OnShutterInternal()
 {
   DOM_CAMERA_LOGI("** SNAP **\n");
-  if (mOnShutterCb) {
+  if (mOnShutterCb.get()) {
     mOnShutterCb->HandleEvent();
   }
 }
@@ -277,7 +277,7 @@ void
 CameraControlImpl::OnClosedInternal()
 {
   DOM_CAMERA_LOGI("Camera hardware was closed\n");
-  if (mOnClosedCb) {
+  if (mOnClosedCb.get()) {
     mOnClosedCb->HandleEvent();
   }
 }
@@ -390,9 +390,10 @@ GetPreviewStreamResult::Run()
    */
   MOZ_ASSERT(NS_IsMainThread());
 
-  if (mOnSuccessCb && nsDOMCameraManager::IsWindowStillActive(mWindowId)) {
+  nsCOMPtr<nsICameraPreviewStreamCallback> onSuccess = mOnSuccessCb.get();
+  if (onSuccess && nsDOMCameraManager::IsWindowStillActive(mWindowId)) {
     nsCOMPtr<nsIDOMMediaStream> stream = new DOMCameraPreview(mCameraControl, mWidth, mHeight, mFramesPerSecond);
-    mOnSuccessCb->HandleEvent(stream);
+    onSuccess->HandleEvent(stream);
   }
   return NS_OK;
 }
diff --git a/dom/camera/CameraControlImpl.h b/dom/camera/CameraControlImpl.h
index 4d6c4034c07d..291b64674a73 100644
--- a/dom/camera/CameraControlImpl.h
+++ b/dom/camera/CameraControlImpl.h
@@ -5,8 +5,8 @@
 #ifndef DOM_CAMERA_CAMERACONTROLIMPL_H
 #define DOM_CAMERA_CAMERACONTROLIMPL_H
 
-#include "nsCOMPtr.h"
 #include "nsDOMFile.h"
+#include "nsProxyRelease.h"
 #include "DictionaryHelpers.h"
 #include "nsIDOMDeviceStorage.h"
 #include "DOMCameraManager.h"
@@ -143,13 +143,13 @@ protected:
    */
   DOMCameraPreview*   mDOMPreview;
 
-  nsCOMPtr<nsICameraAutoFocusCallback>      mAutoFocusOnSuccessCb;
-  nsCOMPtr<nsICameraErrorCallback>          mAutoFocusOnErrorCb;
-  nsCOMPtr<nsICameraTakePictureCallback>    mTakePictureOnSuccessCb;
-  nsCOMPtr<nsICameraErrorCallback>          mTakePictureOnErrorCb;
-  nsCOMPtr<nsICameraShutterCallback>        mOnShutterCb;
-  nsCOMPtr<nsICameraClosedCallback>         mOnClosedCb;
-  nsCOMPtr<nsICameraRecorderStateChange>    mOnRecorderStateChangeCb;
+  nsMainThreadPtrHandle<nsICameraAutoFocusCallback>   mAutoFocusOnSuccessCb;
+  nsMainThreadPtrHandle<nsICameraErrorCallback>       mAutoFocusOnErrorCb;
+  nsMainThreadPtrHandle<nsICameraTakePictureCallback> mTakePictureOnSuccessCb;
+  nsMainThreadPtrHandle<nsICameraErrorCallback>       mTakePictureOnErrorCb;
+  nsMainThreadPtrHandle<nsICameraShutterCallback>     mOnShutterCb;
+  nsMainThreadPtrHandle<nsICameraClosedCallback>      mOnClosedCb;
+  nsMainThreadPtrHandle<nsICameraRecorderStateChange> mOnRecorderStateChangeCb;
 
 private:
   CameraControlImpl(const CameraControlImpl&) MOZ_DELETE;
@@ -161,7 +161,7 @@ class CameraErrorResult : public nsRunnable
 {
 public:
   CameraErrorResult(nsICameraErrorCallback* onError, const nsString& aErrorMsg, uint64_t aWindowId)
-    : mOnErrorCb(onError)
+    : mOnErrorCb(new nsMainThreadPtrHolder<nsICameraErrorCallback>(onError))
     , mErrorMsg(aErrorMsg)
     , mWindowId(aWindowId)
   { }
@@ -170,14 +170,14 @@ public:
   {
     MOZ_ASSERT(NS_IsMainThread());
 
-    if (mOnErrorCb && nsDOMCameraManager::IsWindowStillActive(mWindowId)) {
+    if (mOnErrorCb.get() && nsDOMCameraManager::IsWindowStillActive(mWindowId)) {
       mOnErrorCb->HandleEvent(mErrorMsg);
     }
     return NS_OK;
   }
 
 protected:
-  nsCOMPtr<nsICameraErrorCallback> mOnErrorCb;
+  nsMainThreadPtrHandle<nsICameraErrorCallback> mOnErrorCb;
   const nsString mErrorMsg;
   uint64_t mWindowId;
 };
@@ -186,7 +186,7 @@ protected:
 class GetPreviewStreamResult : public nsRunnable
 {
 public:
-  GetPreviewStreamResult(CameraControlImpl* aCameraControl, uint32_t aWidth, uint32_t aHeight, uint32_t aFramesPerSecond, nsICameraPreviewStreamCallback* onSuccess, uint64_t aWindowId)
+  GetPreviewStreamResult(CameraControlImpl* aCameraControl, uint32_t aWidth, uint32_t aHeight, uint32_t aFramesPerSecond, nsMainThreadPtrHandle<nsICameraPreviewStreamCallback>& onSuccess, uint64_t aWindowId)
     : mCameraControl(aCameraControl)
     , mWidth(aWidth)
     , mHeight(aHeight)
@@ -210,7 +210,7 @@ protected:
   uint32_t mWidth;
   uint32_t mHeight;
   uint32_t mFramesPerSecond;
-  nsCOMPtr<nsICameraPreviewStreamCallback> mOnSuccessCb;
+  nsMainThreadPtrHandle<nsICameraPreviewStreamCallback> mOnSuccessCb;
   uint64_t mWindowId;
 };
 
@@ -221,8 +221,8 @@ public:
   GetPreviewStreamTask(CameraControlImpl* aCameraControl, dom::CameraSize aSize, nsICameraPreviewStreamCallback* onSuccess, nsICameraErrorCallback* onError)
     : mSize(aSize)
     , mCameraControl(aCameraControl)
-    , mOnSuccessCb(onSuccess)
-    , mOnErrorCb(onError)
+    , mOnSuccessCb(new nsMainThreadPtrHolder<nsICameraPreviewStreamCallback>(onSuccess))
+    , mOnErrorCb(new nsMainThreadPtrHolder<nsICameraErrorCallback>(onError))
   {
     DOM_CAMERA_LOGT("%s:%d : this=%p\n", __func__, __LINE__, this);
   }
@@ -236,7 +236,7 @@ public:
   {
     nsresult rv = mCameraControl->GetPreviewStreamImpl(this);
 
-    if (NS_FAILED(rv) && mOnErrorCb) {
+    if (NS_FAILED(rv) && mOnErrorCb.get()) {
       rv = NS_DispatchToMainThread(new CameraErrorResult(mOnErrorCb, NS_LITERAL_STRING("FAILURE"), mCameraControl->GetWindowId()));
       NS_ENSURE_SUCCESS(rv, rv);
     }
@@ -245,8 +245,8 @@ public:
 
   dom::CameraSize mSize;
   nsRefPtr<CameraControlImpl> mCameraControl;
-  nsCOMPtr<nsICameraPreviewStreamCallback> mOnSuccessCb;
-  nsCOMPtr<nsICameraErrorCallback> mOnErrorCb;
+  nsMainThreadPtrHandle<nsICameraPreviewStreamCallback> mOnSuccessCb;
+  nsMainThreadPtrHandle<nsICameraErrorCallback> mOnErrorCb;
 };
 
 // Return the autofocus status to JS.  Runs on the main thread.
@@ -255,7 +255,7 @@ class AutoFocusResult : public nsRunnable
 public:
   AutoFocusResult(bool aSuccess, nsICameraAutoFocusCallback* onSuccess, uint64_t aWindowId)
     : mSuccess(aSuccess)
-    , mOnSuccessCb(onSuccess)
+    , mOnSuccessCb(new nsMainThreadPtrHolder<nsICameraAutoFocusCallback>(onSuccess))
     , mWindowId(aWindowId)
   { }
 
@@ -265,7 +265,7 @@ public:
   {
     MOZ_ASSERT(NS_IsMainThread());
 
-    if (mOnSuccessCb && nsDOMCameraManager::IsWindowStillActive(mWindowId)) {
+    if (mOnSuccessCb.get() && nsDOMCameraManager::IsWindowStillActive(mWindowId)) {
       mOnSuccessCb->HandleEvent(mSuccess);
     }
     return NS_OK;
@@ -273,7 +273,7 @@ public:
 
 protected:
   bool mSuccess;
-  nsCOMPtr<nsICameraAutoFocusCallback> mOnSuccessCb;
+  nsMainThreadPtrHandle<nsICameraAutoFocusCallback> mOnSuccessCb;
   uint64_t mWindowId;
 };
 
@@ -283,8 +283,8 @@ class AutoFocusTask : public nsRunnable
 public:
   AutoFocusTask(CameraControlImpl* aCameraControl, nsICameraAutoFocusCallback* onSuccess, nsICameraErrorCallback* onError)
     : mCameraControl(aCameraControl)
-    , mOnSuccessCb(onSuccess)
-    , mOnErrorCb(onError)
+    , mOnSuccessCb(new nsMainThreadPtrHolder<nsICameraAutoFocusCallback>(onSuccess))
+    , mOnErrorCb(new nsMainThreadPtrHolder<nsICameraErrorCallback>(onError))
   {
     DOM_CAMERA_LOGT("%s:%d : this=%p\n", __func__, __LINE__, this);
   }
@@ -300,7 +300,7 @@ public:
     nsresult rv = mCameraControl->AutoFocusImpl(this);
     DOM_CAMERA_LOGT("%s:%d\n", __func__, __LINE__);
 
-    if (NS_FAILED(rv) && mOnErrorCb) {
+    if (NS_FAILED(rv) && mOnErrorCb.get()) {
       rv = NS_DispatchToMainThread(new CameraErrorResult(mOnErrorCb, NS_LITERAL_STRING("FAILURE"), mCameraControl->GetWindowId()));
       NS_ENSURE_SUCCESS(rv, rv);
     }
@@ -308,17 +308,19 @@ public:
   }
 
   nsRefPtr<CameraControlImpl> mCameraControl;
-  nsCOMPtr<nsICameraAutoFocusCallback> mOnSuccessCb;
-  nsCOMPtr<nsICameraErrorCallback> mOnErrorCb;
+  nsMainThreadPtrHandle<nsICameraAutoFocusCallback> mOnSuccessCb;
+  nsMainThreadPtrHandle<nsICameraErrorCallback> mOnErrorCb;
 };
 
 // Return the captured picture to JS.  Runs on the main thread.
 class TakePictureResult : public nsRunnable
 {
 public:
-  TakePictureResult(nsIDOMBlob* aImage, nsICameraTakePictureCallback* onSuccess, uint64_t aWindowId)
-    : mImage(aImage)
-    , mOnSuccessCb(onSuccess)
+  TakePictureResult(uint8_t* aData, uint64_t aLength, const nsAString& aMimeType, nsICameraTakePictureCallback* onSuccess, uint64_t aWindowId)
+    : mData(aData)
+    , mLength(aLength)
+    , mMimeType(aMimeType)
+    , mOnSuccessCb(new nsMainThreadPtrHolder<nsICameraTakePictureCallback>(onSuccess))
     , mWindowId(aWindowId)
   {
     DOM_CAMERA_LOGT("%s:%d : this=%p\n", __func__, __LINE__, this);
@@ -334,16 +336,21 @@ public:
     MOZ_ASSERT(NS_IsMainThread());
 
     DOM_CAMERA_LOGT("%s:%d : this=%p\n", __func__, __LINE__, this);
-    if (mOnSuccessCb && nsDOMCameraManager::IsWindowStillActive(mWindowId)) {
-      mOnSuccessCb->HandleEvent(mImage);
+    if (mOnSuccessCb.get() && nsDOMCameraManager::IsWindowStillActive(mWindowId)) {
+      nsCOMPtr<nsIDOMBlob> image = new nsDOMMemoryFile(static_cast<void*>(mData), static_cast<uint64_t>(mLength), mMimeType);
+      mOnSuccessCb->HandleEvent(image);
+    } else {
+      delete[] mData;
     }
     DOM_CAMERA_LOGT("%s:%d : this=%p\n", __func__, __LINE__, this);
     return NS_OK;
   }
 
 protected:
-  nsCOMPtr<nsIDOMBlob> mImage;
-  nsCOMPtr<nsICameraTakePictureCallback> mOnSuccessCb;
+  uint8_t* mData;
+  uint64_t mLength;
+  nsString mMimeType;
+  nsMainThreadPtrHandle<nsICameraTakePictureCallback> mOnSuccessCb;
   uint64_t mWindowId;
 };
 
@@ -357,8 +364,8 @@ public:
     , mRotation(aRotation)
     , mFileFormat(aFileFormat)
     , mPosition(aPosition)
-    , mOnSuccessCb(onSuccess)
-    , mOnErrorCb(onError)
+    , mOnSuccessCb(new nsMainThreadPtrHolder<nsICameraTakePictureCallback>(onSuccess))
+    , mOnErrorCb(new nsMainThreadPtrHolder<nsICameraErrorCallback>(onError))
   {
     DOM_CAMERA_LOGT("%s:%d : this=%p\n", __func__, __LINE__, this);
   }
@@ -374,7 +381,7 @@ public:
     nsresult rv = mCameraControl->TakePictureImpl(this);
     DOM_CAMERA_LOGT("%s:%d\n", __func__, __LINE__);
 
-    if (NS_FAILED(rv) && mOnErrorCb) {
+    if (NS_FAILED(rv) && mOnErrorCb.get()) {
       rv = NS_DispatchToMainThread(new CameraErrorResult(mOnErrorCb, NS_LITERAL_STRING("FAILURE"), mCameraControl->GetWindowId()));
       NS_ENSURE_SUCCESS(rv, rv);
     }
@@ -386,8 +393,8 @@ public:
   int32_t mRotation;
   nsString mFileFormat;
   dom::CameraPosition mPosition;
-  nsCOMPtr<nsICameraTakePictureCallback> mOnSuccessCb;
-  nsCOMPtr<nsICameraErrorCallback> mOnErrorCb;
+  nsMainThreadPtrHandle<nsICameraTakePictureCallback> mOnSuccessCb;
+  nsMainThreadPtrHandle<nsICameraErrorCallback> mOnErrorCb;
 };
 
 // Return the result of starting recording.  Runs on the main thread.
@@ -395,7 +402,7 @@ class StartRecordingResult : public nsRunnable
 {
 public:
   StartRecordingResult(nsICameraStartRecordingCallback* onSuccess, uint64_t aWindowId)
-    : mOnSuccessCb(onSuccess)
+    : mOnSuccessCb(new nsMainThreadPtrHolder<nsICameraStartRecordingCallback>(onSuccess))
     , mWindowId(aWindowId)
   { }
 
@@ -405,14 +412,14 @@ public:
   {
     MOZ_ASSERT(NS_IsMainThread());
 
-    if (mOnSuccessCb && nsDOMCameraManager::IsWindowStillActive(mWindowId)) {
+    if (mOnSuccessCb.get() && nsDOMCameraManager::IsWindowStillActive(mWindowId)) {
       mOnSuccessCb->HandleEvent();
     }
     return NS_OK;
   }
 
 protected:
-  nsCOMPtr<nsICameraStartRecordingCallback> mOnSuccessCb;
+  nsMainThreadPtrHandle<nsICameraStartRecordingCallback> mOnSuccessCb;
   uint64_t mWindowId;
 };
 
@@ -425,8 +432,8 @@ public:
     , mOptions(aOptions)
     , mFolder(aFolder)
     , mFilename(aFilename)
-    , mOnSuccessCb(onSuccess)
-    , mOnErrorCb(onError)
+    , mOnSuccessCb(new nsMainThreadPtrHolder<nsICameraStartRecordingCallback>(onSuccess))
+    , mOnErrorCb(new nsMainThreadPtrHolder<nsICameraErrorCallback>(onError))
     , mWindowId(aWindowId)
   {
     DOM_CAMERA_LOGT("%s:%d : this=%p\n", __func__, __LINE__, this);
@@ -461,8 +468,8 @@ public:
   dom::CameraStartRecordingOptions mOptions;
   nsCOMPtr<nsIFile> mFolder;
   nsString mFilename;
-  nsCOMPtr<nsICameraStartRecordingCallback> mOnSuccessCb;
-  nsCOMPtr<nsICameraErrorCallback> mOnErrorCb;
+  nsMainThreadPtrHandle<nsICameraStartRecordingCallback> mOnSuccessCb;
+  nsMainThreadPtrHandle<nsICameraErrorCallback> mOnErrorCb;
   uint64_t mWindowId;
 };
 
@@ -556,8 +563,8 @@ class GetPreviewStreamVideoModeResult : public nsRunnable
 {
 public:
   GetPreviewStreamVideoModeResult(nsIDOMMediaStream* aStream, nsICameraPreviewStreamCallback* onSuccess)
-     : mStream(aStream)
-     , mOnSuccessCb(onSuccess)
+    : mStream(new nsMainThreadPtrHolder<nsIDOMMediaStream>(aStream))
+    , mOnSuccessCb(new nsMainThreadPtrHolder<nsICameraPreviewStreamCallback>(onSuccess))
   {
     DOM_CAMERA_LOGT("%s:%d : this=%p\n", __func__, __LINE__, this);
   }
@@ -571,15 +578,15 @@ public:
   {
     MOZ_ASSERT(NS_IsMainThread());
 
-    if (mOnSuccessCb) {
+    if (mOnSuccessCb.get()) {
       mOnSuccessCb->HandleEvent(mStream);
     }
     return NS_OK;
   }
 
 protected:
-  nsCOMPtr<nsIDOMMediaStream> mStream;
-  nsCOMPtr<nsICameraPreviewStreamCallback> mOnSuccessCb;
+  nsMainThreadPtrHandle<nsIDOMMediaStream> mStream;
+  nsMainThreadPtrHandle<nsICameraPreviewStreamCallback> mOnSuccessCb;
 };
 
 // Get the video mode preview stream.
@@ -589,8 +596,8 @@ public:
   GetPreviewStreamVideoModeTask(CameraControlImpl* aCameraControl, dom::CameraRecorderOptions aOptions,  nsICameraPreviewStreamCallback* onSuccess, nsICameraErrorCallback* onError)
     : mCameraControl(aCameraControl)
     , mOptions(aOptions)
-    , mOnSuccessCb(onSuccess)
-    , mOnErrorCb(onError)
+    , mOnSuccessCb(new nsMainThreadPtrHolder<nsICameraPreviewStreamCallback>(onSuccess))
+    , mOnErrorCb(new nsMainThreadPtrHolder<nsICameraErrorCallback>(onError))
   { }
 
   NS_IMETHOD Run()
@@ -599,7 +606,7 @@ public:
     nsresult rv = mCameraControl->GetPreviewStreamVideoModeImpl(this);
     DOM_CAMERA_LOGI("%s:%d -- AFTER IMPL : rv = %d\n", __func__, __LINE__, rv);
 
-    if (NS_FAILED(rv) && mOnErrorCb) {
+    if (NS_FAILED(rv) && mOnErrorCb.get()) {
       rv = NS_DispatchToMainThread(new CameraErrorResult(mOnErrorCb, NS_LITERAL_STRING("FAILURE"), mCameraControl->GetWindowId()));
       NS_ENSURE_SUCCESS(rv, rv);
     }
@@ -608,8 +615,8 @@ public:
 
   nsRefPtr<CameraControlImpl> mCameraControl;
   dom::CameraRecorderOptions mOptions;
-  nsCOMPtr<nsICameraPreviewStreamCallback> mOnSuccessCb;
-  nsCOMPtr<nsICameraErrorCallback> mOnErrorCb;
+  nsMainThreadPtrHandle<nsICameraPreviewStreamCallback> mOnSuccessCb;
+  nsMainThreadPtrHandle<nsICameraErrorCallback> mOnErrorCb;
 };
 
 // Return the result of releasing the camera hardware.  Runs on the main thread.
@@ -617,7 +624,7 @@ class ReleaseHardwareResult : public nsRunnable
 {
 public:
   ReleaseHardwareResult(nsICameraReleaseCallback* onSuccess, uint64_t aWindowId)
-    : mOnSuccessCb(onSuccess)
+    : mOnSuccessCb(new nsMainThreadPtrHolder<nsICameraReleaseCallback>(onSuccess))
     , mWindowId(aWindowId)
   {
     DOM_CAMERA_LOGT("%s:%d : this=%p\n", __func__, __LINE__, this);
@@ -632,14 +639,14 @@ public:
   {
     MOZ_ASSERT(NS_IsMainThread());
 
-    if (mOnSuccessCb && nsDOMCameraManager::IsWindowStillActive(mWindowId)) {
+    if (mOnSuccessCb.get() && nsDOMCameraManager::IsWindowStillActive(mWindowId)) {
       mOnSuccessCb->HandleEvent();
     }
     return NS_OK;
   }
 
 protected:
-  nsCOMPtr<nsICameraReleaseCallback> mOnSuccessCb;
+  nsMainThreadPtrHandle<nsICameraReleaseCallback> mOnSuccessCb;
   uint64_t mWindowId;
 };
 
@@ -649,8 +656,8 @@ class ReleaseHardwareTask : public nsRunnable
 public:
   ReleaseHardwareTask(CameraControlImpl* aCameraControl, nsICameraReleaseCallback* onSuccess, nsICameraErrorCallback* onError)
     : mCameraControl(aCameraControl)
-    , mOnSuccessCb(onSuccess)
-    , mOnErrorCb(onError)
+    , mOnSuccessCb(new nsMainThreadPtrHolder<nsICameraReleaseCallback>(onSuccess))
+    , mOnErrorCb(new nsMainThreadPtrHolder<nsICameraErrorCallback>(onError))
   {
     DOM_CAMERA_LOGT("%s:%d : this=%p\n", __func__, __LINE__, this);
   }
@@ -666,7 +673,7 @@ public:
     nsresult rv = mCameraControl->ReleaseHardwareImpl(this);
     DOM_CAMERA_LOGT("%s:%d\n", __func__, __LINE__);
 
-    if (NS_FAILED(rv) && mOnErrorCb) {
+    if (NS_FAILED(rv) && mOnErrorCb.get()) {
       rv = NS_DispatchToMainThread(new CameraErrorResult(mOnErrorCb, NS_LITERAL_STRING("FAILURE"), mCameraControl->GetWindowId()));
       NS_ENSURE_SUCCESS(rv, rv);
     }
@@ -674,8 +681,8 @@ public:
   }
 
   nsRefPtr<CameraControlImpl> mCameraControl;
-  nsCOMPtr<nsICameraReleaseCallback> mOnSuccessCb;
-  nsCOMPtr<nsICameraErrorCallback> mOnErrorCb;
+  nsMainThreadPtrHandle<nsICameraReleaseCallback> mOnSuccessCb;
+  nsMainThreadPtrHandle<nsICameraErrorCallback> mOnErrorCb;
 };
 
 // Report that the video recorder state has changed.
@@ -683,7 +690,7 @@ class CameraRecorderStateChange : public nsRunnable
 {
 public:
   CameraRecorderStateChange(nsICameraRecorderStateChange* onStateChange, const nsString& aStateMsg, int32_t aStatus, int32_t aTrackNumber, uint64_t aWindowId)
-    : mOnStateChangeCb(onStateChange)
+    : mOnStateChangeCb(new nsMainThreadPtrHolder<nsICameraRecorderStateChange>(onStateChange))
     , mStateMsg(aStateMsg)
     , mStatus(aStatus)
     , mTrackNumber(aTrackNumber)
@@ -694,7 +701,7 @@ public:
   {
     MOZ_ASSERT(NS_IsMainThread());
 
-    if (mOnStateChangeCb && nsDOMCameraManager::IsWindowStillActive(mWindowId)) {
+    if (mOnStateChangeCb.get() && nsDOMCameraManager::IsWindowStillActive(mWindowId)) {
       // For now, just pass the state message and swallow mStatus and mTrackNumber
       mOnStateChangeCb->HandleStateChange(mStateMsg);
     }
@@ -702,7 +709,7 @@ public:
   }
 
 protected:
-  nsCOMPtr<nsICameraRecorderStateChange> mOnStateChangeCb;
+  nsMainThreadPtrHandle<nsICameraRecorderStateChange> mOnStateChangeCb;
   const nsString mStateMsg;
   int32_t mStatus;
   int32_t mTrackNumber;
diff --git a/dom/camera/DOMCameraControl.cpp b/dom/camera/DOMCameraControl.cpp
old mode 100755
new mode 100644
diff --git a/dom/camera/GonkCameraControl.cpp b/dom/camera/GonkCameraControl.cpp
index 5e25c9e00527..f29e20a6ab90 100644
--- a/dom/camera/GonkCameraControl.cpp
+++ b/dom/camera/GonkCameraControl.cpp
@@ -282,6 +282,7 @@ nsGonkCameraControl::Init()
 nsGonkCameraControl::~nsGonkCameraControl()
 {
   DOM_CAMERA_LOGT("%s:%d : this=%p, mHwHandle = %d\n", __func__, __LINE__, this, mHwHandle);
+
   ReleaseHardwareImpl(nullptr);
   if (mRwLock) {
     PRRWLock* lock = mRwLock;
@@ -622,7 +623,8 @@ nsGonkCameraControl::GetPreviewStreamImpl(GetPreviewStreamTask* aGetPreviewStrea
   SetPreviewSize(aGetPreviewStream->mSize.width, aGetPreviewStream->mSize.height);
   DOM_CAMERA_LOGI("picture preview: wanted %d x %d, got %d x %d (%d fps, format %d)\n", aGetPreviewStream->mSize.width, aGetPreviewStream->mSize.height, mWidth, mHeight, mFps, mFormat);
 
-  nsCOMPtr<GetPreviewStreamResult> getPreviewStreamResult = new GetPreviewStreamResult(this, mWidth, mHeight, mFps, aGetPreviewStream->mOnSuccessCb, mWindowId);
+  nsMainThreadPtrHandle<nsICameraPreviewStreamCallback> onSuccess = aGetPreviewStream->mOnSuccessCb;
+  nsCOMPtr<GetPreviewStreamResult> getPreviewStreamResult = new GetPreviewStreamResult(this, mWidth, mHeight, mFps, onSuccess, mWindowId);
   return NS_DispatchToMainThread(getPreviewStreamResult);
 }
 
@@ -678,16 +680,16 @@ nsGonkCameraControl::StopPreviewImpl(StopPreviewTask* aStopPreview)
 nsresult
 nsGonkCameraControl::AutoFocusImpl(AutoFocusTask* aAutoFocus)
 {
-  nsCOMPtr<nsICameraAutoFocusCallback> cb = mAutoFocusOnSuccessCb;
-  if (cb) {
+  nsMainThreadPtrHandle<nsICameraAutoFocusCallback> cb = mAutoFocusOnSuccessCb;
+  if (cb.get()) {
     /**
      * We already have a callback, so someone has already
      * called autoFocus() -- cancel it.
      */
     mAutoFocusOnSuccessCb = nullptr;
-    nsCOMPtr<nsICameraErrorCallback> ecb = mAutoFocusOnErrorCb;
+    nsMainThreadPtrHandle<nsICameraErrorCallback> ecb = mAutoFocusOnErrorCb;
     mAutoFocusOnErrorCb = nullptr;
-    if (ecb) {
+    if (ecb.get()) {
       nsresult rv = NS_DispatchToMainThread(new CameraErrorResult(ecb, NS_LITERAL_STRING("CANCELLED"), mWindowId));
       NS_ENSURE_SUCCESS(rv, rv);
     }
@@ -746,16 +748,16 @@ nsGonkCameraControl::SetupThumbnail(uint32_t aPictureWidth, uint32_t aPictureHei
 nsresult
 nsGonkCameraControl::TakePictureImpl(TakePictureTask* aTakePicture)
 {
-  nsCOMPtr<nsICameraTakePictureCallback> cb = mTakePictureOnSuccessCb;
-  if (cb) {
+  nsMainThreadPtrHandle<nsICameraTakePictureCallback> cb = mTakePictureOnSuccessCb;
+  if (cb.get()) {
     /**
      * We already have a callback, so someone has already
      * called TakePicture() -- cancel it.
      */
     mTakePictureOnSuccessCb = nullptr;
-    nsCOMPtr<nsICameraErrorCallback> ecb = mTakePictureOnErrorCb;
+    nsMainThreadPtrHandle<nsICameraErrorCallback> ecb = mTakePictureOnErrorCb;
     mTakePictureOnErrorCb = nullptr;
-    if (ecb) {
+    if (ecb.get()) {
       nsresult rv = NS_DispatchToMainThread(new CameraErrorResult(ecb, NS_LITERAL_STRING("CANCELLED"), mWindowId));
       NS_ENSURE_SUCCESS(rv, rv);
     }
@@ -889,6 +891,8 @@ nsGonkCameraControl::StartRecordingImpl(StartRecordingTask* aStartRecording)
 
   if (mRecorder->start() != OK) {
     DOM_CAMERA_LOGE("mRecorder->start() failed\n");
+    // important: we MUST destroy the recorder if start() fails!
+    mRecorder = nullptr;
     return NS_ERROR_FAILURE;
   }
 
@@ -928,7 +932,6 @@ nsGonkCameraControl::StopRecordingImpl(StopRecordingTask* aStopRecording)
   NS_ENSURE_TRUE(mRecorder, NS_OK);
 
   mRecorder->stop();
-  delete mRecorder;
   mRecorder = nullptr;
 
   // notify DeviceStorage that the new video file is closed and ready
@@ -974,8 +977,7 @@ nsGonkCameraControl::TakePictureComplete(uint8_t* aData, uint32_t aLength)
   memcpy(data, aData, aLength);
 
   // TODO: see bug 779144.
-  nsIDOMBlob* blob = new nsDOMMemoryFile(static_cast<void*>(data), static_cast<uint64_t>(aLength), NS_LITERAL_STRING("image/jpeg"));
-  nsCOMPtr<nsIRunnable> takePictureResult = new TakePictureResult(blob, mTakePictureOnSuccessCb, mWindowId);
+  nsCOMPtr<nsIRunnable> takePictureResult = new TakePictureResult(data, aLength, NS_LITERAL_STRING("image/jpeg"), mTakePictureOnSuccessCb, mWindowId);
   /**
    * Remember to set these to null so that we don't hold any extra
    * references to our document's window.
@@ -1331,9 +1333,9 @@ nsGonkCameraControl::ReleaseHardwareImpl(ReleaseHardwareTask* aReleaseHardware)
   StopPreviewInternal(true /* forced */);
 
   // release the hardware handle
-  GonkCameraHardware::ReleaseHandle(mHwHandle);
+  GonkCameraHardware::ReleaseHandle(mHwHandle, true /* unregister */);
 
-  if (aReleaseHardware && aReleaseHardware->mOnSuccessCb) {
+  if (aReleaseHardware && aReleaseHardware->mOnSuccessCb.get()) {
     nsCOMPtr<nsIRunnable> releaseHardwareResult = new ReleaseHardwareResult(aReleaseHardware->mOnSuccessCb, mWindowId);
     return NS_DispatchToMainThread(releaseHardwareResult);
   }
diff --git a/dom/camera/GonkCameraControl.h b/dom/camera/GonkCameraControl.h
index ff0654464ba9..0c2f80ef0fa5 100644
--- a/dom/camera/GonkCameraControl.h
+++ b/dom/camera/GonkCameraControl.h
@@ -104,7 +104,7 @@ protected:
   uint32_t                  mDiscardedFrameCount;
 
   android::MediaProfiles*   mMediaProfiles;
-  android::GonkRecorder*    mRecorder;
+  nsRefPtr<android::GonkRecorder> mRecorder;
 
   // camcorder profile settings for the desired quality level
   nsRefPtr<GonkRecorderProfileManager> mProfileManager;
diff --git a/dom/camera/GonkCameraHwMgr.cpp b/dom/camera/GonkCameraHwMgr.cpp
index 36c0fe5ce145..24281e58e202 100644
--- a/dom/camera/GonkCameraHwMgr.cpp
+++ b/dom/camera/GonkCameraHwMgr.cpp
@@ -234,7 +234,8 @@ GonkCameraHardware* GonkCameraHardware::sHw         = nullptr;
 uint32_t            GonkCameraHardware::sHwHandle   = 0;
 
 void
-GonkCameraHardware::ReleaseHandle(uint32_t aHwHandle)
+GonkCameraHardware::ReleaseHandle(uint32_t aHwHandle,
+                                  bool aUnregisterTarget = false)
 {
   GonkCameraHardware* hw = GetHardware(aHwHandle);
   DOM_CAMERA_LOGI("%s: aHwHandle = %d, hw = %p (sHwHandle = %d)\n", __func__, aHwHandle, (void*)hw, sHwHandle);
@@ -253,6 +254,9 @@ GonkCameraHardware::ReleaseHandle(uint32_t aHwHandle)
     window->abandon();
   }
   DOM_CAMERA_LOGT("%s: after: sHwHandle = %d\n", __func__, sHwHandle);
+  if (aUnregisterTarget) {
+    hw->mTarget = nullptr;
+  }
   delete hw;     // destroy the camera hardware instance
 }
 
diff --git a/dom/camera/GonkCameraHwMgr.h b/dom/camera/GonkCameraHwMgr.h
index a028e0082c72..78c09ddadeb7 100644
--- a/dom/camera/GonkCameraHwMgr.h
+++ b/dom/camera/GonkCameraHwMgr.h
@@ -51,7 +51,7 @@ protected:
 public:
   virtual void    OnNewFrame() MOZ_OVERRIDE;
 
-  static void     ReleaseHandle(uint32_t aHwHandle);
+  static void     ReleaseHandle(uint32_t aHwHandle, bool aUnregisterTarget);
   static uint32_t GetHandle(GonkCamera* aTarget, uint32_t aCamera);
 
   /**
diff --git a/dom/camera/GonkCameraSource.cpp b/dom/camera/GonkCameraSource.cpp
index 73331eda9b80..89d5f7719740 100644
--- a/dom/camera/GonkCameraSource.cpp
+++ b/dom/camera/GonkCameraSource.cpp
@@ -513,12 +513,14 @@ GonkCameraSource::~GonkCameraSource() {
     }
 }
 
-void GonkCameraSource::startCameraRecording() {
+int GonkCameraSource::startCameraRecording() {
     LOGV("startCameraRecording");
-    CHECK_EQ(OK, GonkCameraHardware::StartRecording(mCameraHandle));
+    return GonkCameraHardware::StartRecording(mCameraHandle);
 }
 
 status_t GonkCameraSource::start(MetaData *meta) {
+    int rv;
+
     LOGV("start");
     CHECK(!mStarted);
     if (mInitCheck != OK) {
@@ -542,10 +544,10 @@ status_t GonkCameraSource::start(MetaData *meta) {
     // Register a listener with GonkCameraHardware so that we can get callbacks
     GonkCameraHardware::SetListener(mCameraHandle, new GonkCameraSourceListener(this));
 
-    startCameraRecording();
+    rv = startCameraRecording();
 
-    mStarted = true;
-    return OK;
+    mStarted = (rv == OK);
+    return rv;
 }
 
 void GonkCameraSource::stopCameraRecording() {
diff --git a/dom/camera/GonkCameraSource.h b/dom/camera/GonkCameraSource.h
index fe58f96770cc..eaa608785f53 100644
--- a/dom/camera/GonkCameraSource.h
+++ b/dom/camera/GonkCameraSource.h
@@ -102,7 +102,7 @@ protected:
                  Size videoSize, int32_t frameRate,
                  bool storeMetaDataInVideoBuffers = false);
 
-    virtual void startCameraRecording();
+    virtual int startCameraRecording();
     virtual void stopCameraRecording();
     virtual void releaseRecordingFrame(const sp<IMemory>& frame);
 
diff --git a/dom/camera/GonkRecorder.h b/dom/camera/GonkRecorder.h
index be05ef745852..dbdf1c182abc 100644
--- a/dom/camera/GonkRecorder.h
+++ b/dom/camera/GonkRecorder.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 The Android Open Source Project
+ * Copyright (C) 2013 Mozilla Foundation
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -15,9 +16,10 @@
  */
 
 #ifndef GONK_RECORDER_H_
-
 #define GONK_RECORDER_H_
 
+#include "nsISupportsImpl.h"
+
 #include <media/mediarecorder.h>
 #include <camera/CameraParameters.h>
 #include <utils/String8.h>
@@ -34,8 +36,9 @@ struct AudioSource;
 class MediaProfiles;
 
 struct GonkRecorder {
+    NS_INLINE_DECL_THREADSAFE_REFCOUNTING(GonkRecorder)
+
     GonkRecorder();
-    virtual ~GonkRecorder();
 
     virtual status_t init();
     virtual status_t setAudioSource(audio_source_t as);
@@ -60,6 +63,9 @@ struct GonkRecorder {
     virtual status_t dump(int fd, const Vector<String16>& args) const;
     // Querying a SurfaceMediaSourcer
 
+protected:
+    virtual ~GonkRecorder();
+
 private:
     sp<IMediaRecorderClient> mListener;
     sp<MediaWriter> mWriter;
diff --git a/dom/devicestorage/DeviceStorageRequestParent.cpp b/dom/devicestorage/DeviceStorageRequestParent.cpp
index 78076842671b..25a6ceb38bfe 100644
--- a/dom/devicestorage/DeviceStorageRequestParent.cpp
+++ b/dom/devicestorage/DeviceStorageRequestParent.cpp
@@ -11,7 +11,7 @@
 #include "mozilla/dom/ipc/Blob.h"
 #include "ContentParent.h"
 #include "nsProxyRelease.h"
-#include "AppProcessPermissions.h"
+#include "AppProcessChecker.h"
 #include "mozilla/Preferences.h"
 
 namespace mozilla {
diff --git a/dom/imptests/failures/webapps/DOMCore/tests/approved/test_interfaces.html.json b/dom/imptests/failures/webapps/DOMCore/tests/approved/test_interfaces.html.json
index 2ff175c6b278..1de4957518f1 100644
--- a/dom/imptests/failures/webapps/DOMCore/tests/approved/test_interfaces.html.json
+++ b/dom/imptests/failures/webapps/DOMCore/tests/approved/test_interfaces.html.json
@@ -93,20 +93,7 @@
   "Stringification of document.querySelector(\"[id]\").attributes[0]": "debug",
   "CharacterData interface: operation remove()": true,
   "CharacterData interface: document.createTextNode(\"abc\") must inherit property \"remove\" with the proper type (7)": true,
-  "ProcessingInstruction interface: existence and properties of interface object": true,
-  "ProcessingInstruction interface: existence and properties of interface prototype object": true,
-  "ProcessingInstruction interface: existence and properties of interface prototype object's \"constructor\" property": true,
-  "ProcessingInstruction interface: attribute target": true,
-  "Stringification of xmlDoc.createProcessingInstruction(\"abc\", \"def\")": "debug",
-  "CharacterData interface: calling substringData(unsigned long,unsigned long) on xmlDoc.createProcessingInstruction(\"abc\", \"def\") with too few arguments must throw TypeError": true,
-  "CharacterData interface: calling appendData(DOMString) on xmlDoc.createProcessingInstruction(\"abc\", \"def\") with too few arguments must throw TypeError": true,
-  "CharacterData interface: calling insertData(unsigned long,DOMString) on xmlDoc.createProcessingInstruction(\"abc\", \"def\") with too few arguments must throw TypeError": true,
-  "CharacterData interface: calling deleteData(unsigned long,unsigned long) on xmlDoc.createProcessingInstruction(\"abc\", \"def\") with too few arguments must throw TypeError": true,
-  "CharacterData interface: calling replaceData(unsigned long,unsigned long,DOMString) on xmlDoc.createProcessingInstruction(\"abc\", \"def\") with too few arguments must throw TypeError": true,
   "CharacterData interface: xmlDoc.createProcessingInstruction(\"abc\", \"def\") must inherit property \"remove\" with the proper type (7)": true,
-  "EventTarget interface: calling addEventListener(DOMString,EventListener,boolean) on xmlDoc.createProcessingInstruction(\"abc\", \"def\") with too few arguments must throw TypeError": true,
-  "EventTarget interface: calling removeEventListener(DOMString,EventListener,boolean) on xmlDoc.createProcessingInstruction(\"abc\", \"def\") with too few arguments must throw TypeError": true,
-  "EventTarget interface: calling dispatchEvent(Event) on xmlDoc.createProcessingInstruction(\"abc\", \"def\") with too few arguments must throw TypeError": true,
   "CharacterData interface: document.createComment(\"abc\") must inherit property \"remove\" with the proper type (7)": true,
   "Range interface: existence and properties of interface object": true,
   "Range interface: existence and properties of interface prototype object": true,
diff --git a/dom/indexedDB/ipc/IndexedDBParent.cpp b/dom/indexedDB/ipc/IndexedDBParent.cpp
index 963c9797b9d7..f87de87201b0 100644
--- a/dom/indexedDB/ipc/IndexedDBParent.cpp
+++ b/dom/indexedDB/ipc/IndexedDBParent.cpp
@@ -12,7 +12,7 @@
 #include "nsIJSContextStack.h"
 #include "nsIXPConnect.h"
 
-#include "mozilla/AppProcessPermissions.h"
+#include "mozilla/AppProcessChecker.h"
 #include "mozilla/Assertions.h"
 #include "mozilla/unused.h"
 #include "mozilla/Util.h"
diff --git a/dom/interfaces/events/nsIDOMDeviceProximityEvent.idl b/dom/interfaces/events/nsIDOMDeviceProximityEvent.idl
index 575b7111ac2c..fac9da511fac 100644
--- a/dom/interfaces/events/nsIDOMDeviceProximityEvent.idl
+++ b/dom/interfaces/events/nsIDOMDeviceProximityEvent.idl
@@ -21,7 +21,7 @@ interface nsIDOMDeviceProximityEvent : nsIDOMEvent
 
 dictionary DeviceProximityEventInit : EventInit
 {
-   double value;
-   double min;
-   double max;
+   double value = Infinity;
+   double min = -Infinity;
+   double max = Infinity;
 };
diff --git a/dom/interfaces/html/nsIDOMHTMLStyleElement.idl b/dom/interfaces/html/nsIDOMHTMLStyleElement.idl
index b3a93b91a368..b552a63d4bec 100644
--- a/dom/interfaces/html/nsIDOMHTMLStyleElement.idl
+++ b/dom/interfaces/html/nsIDOMHTMLStyleElement.idl
@@ -16,10 +16,11 @@
  * http://www.whatwg.org/specs/web-apps/current-work/
  */
 
-[scriptable, uuid(830D9170-F8EB-4749-B721-16D60D6B0F1B)]
+[scriptable, uuid(f9db1001-faae-46e1-b85f-0a0afb80c5b2)]
 interface nsIDOMHTMLStyleElement : nsIDOMHTMLElement
 {
            attribute boolean          disabled;
            attribute DOMString        media;
            attribute DOMString        type;
+           attribute boolean          scoped;
 };
diff --git a/dom/interfaces/svg/nsIDOMSVGStyleElement.idl b/dom/interfaces/svg/nsIDOMSVGStyleElement.idl
index cf69c59ec2ee..df74a2596695 100644
--- a/dom/interfaces/svg/nsIDOMSVGStyleElement.idl
+++ b/dom/interfaces/svg/nsIDOMSVGStyleElement.idl
@@ -5,7 +5,7 @@
 
 #include "nsIDOMSVGElement.idl"
 
-[scriptable, uuid(53DA8F96-E2F0-45AC-B8AE-3CACC5981383)]
+[scriptable, uuid(2fecabb2-4671-4553-9e99-1b8167e3c131)]
 interface nsIDOMSVGStyleElement
   : nsIDOMSVGElement
 {
@@ -17,4 +17,5 @@ interface nsIDOMSVGStyleElement
                        // raises DOMException on setting
   attribute DOMString         title;
                        // raises DOMException on setting
+  attribute boolean           scoped;
 };
diff --git a/dom/ipc/AppProcessPermissions.cpp b/dom/ipc/AppProcessChecker.cpp
similarity index 51%
rename from dom/ipc/AppProcessPermissions.cpp
rename to dom/ipc/AppProcessChecker.cpp
index 25779bede27a..9491413afec2 100644
--- a/dom/ipc/AppProcessPermissions.cpp
+++ b/dom/ipc/AppProcessChecker.cpp
@@ -5,7 +5,7 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this file,
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
-#include "AppProcessPermissions.h"
+#include "AppProcessChecker.h"
 #include "ContentParent.h"
 #include "mozIApplication.h"
 #include "mozilla/hal_sandbox/PHalParent.h"
@@ -19,41 +19,59 @@ using namespace mozilla::services;
 namespace mozilla {
 
 bool
-AssertAppProcessPermission(PBrowserParent* aActor, const char* aPermission)
+AssertAppProcess(PBrowserParent* aActor,
+                 AssertAppProcessType aType,
+                 const char* aCapability)
 {
   if (!aActor) {
-    NS_WARNING("Testing permissions for null actor");
+    NS_WARNING("Testing process capability for null actor");
     return false;
   }
 
   TabParent* tab = static_cast<TabParent*>(aActor);
   nsCOMPtr<mozIApplication> app = tab->GetOwnOrContainingApp();
-  bool hasPermission = false;
+  bool aValid = false;
 
   // isBrowser frames inherit their app descriptor to identify their
-  // data storage, but they don't inherit the permissions associated
+  // data storage, but they don't inherit the capability associated
   // with that descriptor.
   if (app && !tab->IsBrowserElement()) {
-    if (!NS_SUCCEEDED(app->HasPermission(aPermission, &hasPermission))) {
-      hasPermission = false;
+    switch (aType) {
+      case ASSERT_APP_PROCESS_PERMISSION:
+        if (!NS_SUCCEEDED(app->HasPermission(aCapability, &aValid))) {
+          aValid = false;
+        }
+        break;
+      case ASSERT_APP_PROCESS_MANIFEST_URL: {
+        nsAutoString manifestURL;
+        if (NS_SUCCEEDED(app->GetManifestURL(manifestURL)) &&
+            manifestURL.EqualsASCII(aCapability)) {
+          aValid = true;
+        }
+        break;
+      }
+      default:
+        break;
     }
   }
 
-  if (!hasPermission) {
-    printf_stderr("Security problem: Content process does not have `%s' permission.  It will be killed.\n", aPermission);
+  if (!aValid) {
+    printf_stderr("Security problem: Content process does not have `%s'.  It will be killed.\n", aCapability);
     ContentParent* process = static_cast<ContentParent*>(aActor->Manager());
     process->KillHard();
   }
-  return hasPermission;
+  return aValid;
 }
 
 bool
-AssertAppProcessPermission(PContentParent* aActor, const char* aPermission)
+AssertAppProcess(PContentParent* aActor,
+                 AssertAppProcessType aType,
+                 const char* aCapability)
 {
   const InfallibleTArray<PBrowserParent*>& browsers =
     aActor->ManagedPBrowserParent();
   for (uint32_t i = 0; i < browsers.Length(); ++i) {
-    if (AssertAppProcessPermission(browsers[i], aPermission)) {
+    if (AssertAppProcess(browsers[i], aType, aCapability)) {
       return true;
     }
   }
@@ -61,9 +79,11 @@ AssertAppProcessPermission(PContentParent* aActor, const char* aPermission)
 }
 
 bool
-AssertAppProcessPermission(PHalParent* aActor, const char* aPermission)
+AssertAppProcess(PHalParent* aActor,
+                 AssertAppProcessType aType,
+                 const char* aCapability)
 {
-  return AssertAppProcessPermission(aActor->Manager(), aPermission);
+  return AssertAppProcess(aActor->Manager(), aType, aCapability);
 }
 
 } // namespace mozilla
diff --git a/dom/ipc/AppProcessChecker.h b/dom/ipc/AppProcessChecker.h
new file mode 100644
index 000000000000..ddf2ca1910d1
--- /dev/null
+++ b/dom/ipc/AppProcessChecker.h
@@ -0,0 +1,86 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: sw=2 ts=8 et :
+ */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef mozilla_AppProcessChecker_h
+#define mozilla_AppProcessChecker_h
+
+namespace mozilla {
+
+namespace dom {
+class PBrowserParent;
+class PContentParent;
+}
+
+namespace hal_sandbox {
+class PHalParent;
+}
+
+enum AssertAppProcessType {
+  ASSERT_APP_PROCESS_PERMISSION,
+  ASSERT_APP_PROCESS_MANIFEST_URL
+};
+
+/**
+ * Return true iff the specified browser has the specified capability.
+ * If this returns false, the browser didn't have the capability and
+ * will be killed.
+ */
+bool
+AssertAppProcess(mozilla::dom::PBrowserParent* aActor,
+                 AssertAppProcessType aType,
+                 const char* aCapability);
+
+/**
+ * Return true iff any of the PBrowsers loaded in this content process
+ * has the specified capability.  If this returns false, the process
+ * didn't have the capability and will be killed.
+ */
+bool
+AssertAppProcess(mozilla::dom::PContentParent* aActor,
+                 AssertAppProcessType aType,
+                 const char* aCapability);
+
+bool
+AssertAppProcess(mozilla::hal_sandbox::PHalParent* aActor,
+                 AssertAppProcessType aType,
+                 const char* aCapability);
+
+// NB: when adding capability checks for other IPDL actors, please add
+// them to this file and have them delegate to the two functions above
+// as appropriate.  For example,
+//
+//   bool AppProcessHasCapability(PNeckoParent* aActor, AssertAppProcessType aType) {
+//     return AssertAppProcess(aActor->Manager(), aType);
+//   }
+
+/**
+ * Inline function for asserting the process's permission.
+ */
+template<typename T>
+inline bool
+AssertAppProcessPermission(T* aActor,
+                           const char* aPermission) {
+  return AssertAppProcess(aActor,
+                          ASSERT_APP_PROCESS_PERMISSION,
+                          aPermission);
+}
+
+/**
+ * Inline function for asserting the process's manifest URL.
+ */
+template<typename T>
+inline bool
+AssertAppProcessManifestURL(T* aActor,
+                            const char* aManifestURL) {
+  return AssertAppProcess(aActor,
+                          ASSERT_APP_PROCESS_MANIFEST_URL,
+                          aManifestURL);
+}
+
+} // namespace mozilla
+
+#endif // mozilla_AppProcessChecker_h
diff --git a/dom/ipc/AppProcessPermissions.h b/dom/ipc/AppProcessPermissions.h
deleted file mode 100644
index 94472d998dd5..000000000000
--- a/dom/ipc/AppProcessPermissions.h
+++ /dev/null
@@ -1,54 +0,0 @@
-/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
- * vim: sw=2 ts=8 et :
- */
-/* This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this file,
- * You can obtain one at http://mozilla.org/MPL/2.0/. */
-
-#ifndef mozilla_AppProcessPermissions_h
-#define mozilla_AppProcessPermissions_h
-
-namespace mozilla {
-
-namespace dom {
-class PBrowserParent;
-class PContentParent;
-}
-
-namespace hal_sandbox {
-class PHalParent;
-}
-
-/**
- * Return true iff the specified browser has the specified capability.
- * If this returns false, the browser didn't have the permission and
- * will be killed.
- */
-bool
-AssertAppProcessPermission(mozilla::dom::PBrowserParent* aActor,
-                           const char* aPermission);
-
-/**
- * Return true iff any of the PBrowsers loaded in this content process
- * has the specified capability.  If this returns false, the process
- * didn't have the permission and will be killed.
- */
-bool
-AssertAppProcessPermission(mozilla::dom::PContentParent* aActor,
-                           const char* aPermission);
-
-bool
-AssertAppProcessPermission(mozilla::hal_sandbox::PHalParent* aActor,
-                           const char* aPermission);
-
-// NB: when adding capability checks for other IPDL actors, please add
-// them to this file and have them delegate to the two functions above
-// as appropriate.  For example,
-//
-//   bool AppProcessHasCapability(PNeckoParent* aActor) {
-//     return AssertAppProcessPermission(aActor->Manager());
-//   }
-
-} // namespace mozilla
-
-#endif // mozilla_AppProcessPermissions_h
diff --git a/dom/ipc/ContentParent.cpp b/dom/ipc/ContentParent.cpp
index 36d27c6a9603..736d064bb460 100644
--- a/dom/ipc/ContentParent.cpp
+++ b/dom/ipc/ContentParent.cpp
@@ -17,7 +17,7 @@
 
 #include "chrome/common/process_watcher.h"
 
-#include "AppProcessPermissions.h"
+#include "AppProcessChecker.h"
 #include "AudioChannelService.h"
 #include "CrashReporterParent.h"
 #include "IHistory.h"
@@ -712,8 +712,17 @@ ContentParent::ActorDestroy(ActorDestroyReason why)
                 CrashReporterParent* crashReporter =
                     static_cast<CrashReporterParent*>(ManagedPCrashReporterParent()[0]);
 
-                crashReporter->AnnotateCrashReport(NS_LITERAL_CSTRING("URL"),
-                                                   NS_ConvertUTF16toUTF8(mAppManifestURL));
+                // If we're an app process, always stomp the latest URI
+                // loaded in the child process with our manifest URL.  We
+                // would rather associate the crashes with apps than
+                // random child windows loaded in them.
+                //
+                // XXX would be nice if we could get both ...
+                if (!mAppManifestURL.IsEmpty()) {
+                    crashReporter->AnnotateCrashReport(NS_LITERAL_CSTRING("URL"),
+                                                       NS_ConvertUTF16toUTF8(mAppManifestURL));
+                }
+
                 crashReporter->GenerateCrashReport(this, NULL);
 
                 nsAutoString dumpID(crashReporter->ChildDumpID());
@@ -1090,14 +1099,16 @@ ContentParent::RecvFirstIdle()
 
 bool
 ContentParent::RecvAudioChannelGetMuted(const AudioChannelType& aType,
-                                        const bool& aMozHidden,
+                                        const bool& aElementHidden,
+                                        const bool& aElementWasHidden,
                                         bool* aValue)
 {
     nsRefPtr<AudioChannelService> service =
         AudioChannelService::GetAudioChannelService();
     *aValue = false;
     if (service) {
-        *aValue = service->GetMuted(aType, aMozHidden);
+        *aValue = service->GetMutedInternal(aType, mChildID,
+                                            aElementHidden, aElementWasHidden);
     }
     return true;
 }
@@ -1114,12 +1125,24 @@ ContentParent::RecvAudioChannelRegisterType(const AudioChannelType& aType)
 }
 
 bool
-ContentParent::RecvAudioChannelUnregisterType(const AudioChannelType& aType)
+ContentParent::RecvAudioChannelUnregisterType(const AudioChannelType& aType,
+                                              const bool& aElementHidden)
 {
     nsRefPtr<AudioChannelService> service =
         AudioChannelService::GetAudioChannelService();
     if (service) {
-        service->UnregisterType(aType, mChildID);
+        service->UnregisterType(aType, aElementHidden, mChildID);
+    }
+    return true;
+}
+
+bool
+ContentParent::RecvAudioChannelChangedNotification()
+{
+    nsRefPtr<AudioChannelService> service =
+        AudioChannelService::GetAudioChannelService();
+    if (service) {
+       service->SendAudioChannelChangedNotification();
     }
     return true;
 }
@@ -2147,6 +2170,11 @@ ContentParent::CheckPermission(const nsAString& aPermission)
   return AssertAppProcessPermission(this, NS_ConvertUTF16toUTF8(aPermission).get());
 }
 
+bool
+ContentParent::CheckManifestURL(const nsAString& aManifestURL)
+{
+  return AssertAppProcessManifestURL(this, NS_ConvertUTF16toUTF8(aManifestURL).get());
+}
 
 } // namespace dom
 } // namespace mozilla
diff --git a/dom/ipc/ContentParent.h b/dom/ipc/ContentParent.h
index 08ff510f0a41..396a7fe4adf5 100644
--- a/dom/ipc/ContentParent.h
+++ b/dom/ipc/ContentParent.h
@@ -102,6 +102,7 @@ public:
     virtual bool DoSendAsyncMessage(const nsAString& aMessage,
                                     const mozilla::dom::StructuredCloneData& aData);
     virtual bool CheckPermission(const nsAString& aPermission);
+    virtual bool CheckManifestURL(const nsAString& aManifestURL);
 
     /** Notify that a tab was destroyed during normal operation. */
     void NotifyTabDestroyed(PBrowserParent* aTab);
@@ -319,11 +320,15 @@ private:
     virtual bool RecvFirstIdle();
 
     virtual bool RecvAudioChannelGetMuted(const AudioChannelType& aType,
-                                          const bool& aMozHidden,
+                                          const bool& aElementHidden,
+                                          const bool& aElementWasHidden,
                                           bool* aValue);
 
     virtual bool RecvAudioChannelRegisterType(const AudioChannelType& aType);
-    virtual bool RecvAudioChannelUnregisterType(const AudioChannelType& aType);
+    virtual bool RecvAudioChannelUnregisterType(const AudioChannelType& aType,
+                                                const bool& aElementHidden);
+
+    virtual bool RecvAudioChannelChangedNotification();
 
     virtual void ProcessingError(Result what) MOZ_OVERRIDE;
 
diff --git a/dom/ipc/Makefile.in b/dom/ipc/Makefile.in
index d4127692fc65..8dca179ca4b6 100644
--- a/dom/ipc/Makefile.in
+++ b/dom/ipc/Makefile.in
@@ -31,7 +31,7 @@ EXPORTS_NAMESPACES = \
   $(NULL)
 
 EXPORTS_mozilla = \
-  AppProcessPermissions.h \
+  AppProcessChecker.h \
   $(NULL)
 
 EXPORTS_mozilla/dom = \
@@ -55,7 +55,7 @@ EXPORTS_mozilla/dom/ipc = \
   $(NULL)
 
 CPPSRCS = \
-  AppProcessPermissions.cpp \
+  AppProcessChecker.cpp \
   Blob.cpp \
   ContentProcess.cpp \
   ContentParent.cpp \
diff --git a/dom/ipc/PContent.ipdl b/dom/ipc/PContent.ipdl
index 504584b263f8..15e87968221b 100644
--- a/dom/ipc/PContent.ipdl
+++ b/dom/ipc/PContent.ipdl
@@ -433,11 +433,15 @@ parent:
     async FirstIdle();
 
     // Get Muted from the main AudioChannelService.
-    sync AudioChannelGetMuted(AudioChannelType aType, bool aMozHidden)
+    sync AudioChannelGetMuted(AudioChannelType aType, bool aElementHidden,
+                              bool aElementWasHidden)
         returns (bool value);
 
-    async AudioChannelRegisterType(AudioChannelType aType);
-    async AudioChannelUnregisterType(AudioChannelType aType);
+    sync AudioChannelRegisterType(AudioChannelType aType);
+    sync AudioChannelUnregisterType(AudioChannelType aType,
+                                    bool aElementHidden);
+
+    async AudioChannelChangedNotification();
 
 both:
      AsyncMessage(nsString aMessage, ClonedMessageData aData);
diff --git a/dom/ipc/TabChild.cpp b/dom/ipc/TabChild.cpp
index 3aa899aa6249..0e047645a85d 100644
--- a/dom/ipc/TabChild.cpp
+++ b/dom/ipc/TabChild.cpp
@@ -30,6 +30,9 @@
 #include "nsContentUtils.h"
 #include "nsEmbedCID.h"
 #include "nsEventListenerManager.h"
+#ifdef MOZ_CRASHREPORTER
+#include "nsExceptionHandler.h"
+#endif
 #include "mozilla/dom/Element.h"
 #include "nsIAppsService.h"
 #include "nsIBaseWindow.h"
@@ -1089,6 +1092,10 @@ TabChild::RecvLoadURL(const nsCString& uri)
         NS_WARNING("mWebNav->LoadURI failed. Eating exception, what else can I do?");
     }
 
+#ifdef MOZ_CRASHREPORTER
+    CrashReporter::AnnotateCrashReport(NS_LITERAL_CSTRING("URL"), uri);
+#endif
+
     return true;
 }
 
diff --git a/dom/media/MediaManager.cpp b/dom/media/MediaManager.cpp
index 97117ac8a2ae..05404caf6305 100644
--- a/dom/media/MediaManager.cpp
+++ b/dom/media/MediaManager.cpp
@@ -356,7 +356,7 @@ public:
     nsRefPtr<MediaInputPort> port = trackunion->GetStream()->AsProcessedStream()->
       AllocateInputPort(stream, MediaInputPort::FLAG_BLOCK_OUTPUT);
     trackunion->mSourceStream = stream;
-    trackunion->mPort = port;
+    trackunion->mPort = port.forget();
 
     nsPIDOMWindow *window = static_cast<nsPIDOMWindow*>
       (nsGlobalWindow::GetInnerWindowWithId(mWindowID));
@@ -368,8 +368,7 @@ public:
     // Activate our listener. We'll call Start() on the source when get a callback
     // that the MediaStream has started consuming. The listener is freed
     // when the page is invalidated (on navigation or close).
-    mListener->Activate(stream.forget(), port.forget(),
-                        mAudioSource, mVideoSource);
+    mListener->Activate(stream.forget(), mAudioSource, mVideoSource);
 
     // Dispatch to the media thread to ask it to start the sources,
     // because that can take a while
@@ -1069,7 +1068,9 @@ MediaManager::OnNavigation(uint64_t aWindowID)
   for (uint32_t i = 0; i < length; i++) {
     nsRefPtr<GetUserMediaCallbackMediaStreamListener> listener =
       listeners->ElementAt(i);
-    listener->Invalidate(true);
+    if (listener->Stream()) { // aka HasBeenActivate()ed
+      listener->Invalidate();
+    }
     listener->Remove();
   }
   listeners->Clear();
@@ -1232,9 +1233,11 @@ MediaManager::GetActiveMediaCaptureWindows(nsISupportsArray **aArray)
   return NS_OK;
 }
 
+// Can be invoked from EITHER MainThread or MSG thread
 void
-GetUserMediaCallbackMediaStreamListener::Invalidate(bool aNeedsFinish)
+GetUserMediaCallbackMediaStreamListener::Invalidate()
 {
+
   nsRefPtr<MediaOperationRunnable> runnable;
   // We can't take a chance on blocking here, so proxy this to another
   // thread.
@@ -1242,15 +1245,33 @@ GetUserMediaCallbackMediaStreamListener::Invalidate(bool aNeedsFinish)
   // source stream info.
   runnable = new MediaOperationRunnable(MEDIA_STOP,
                                         this, mAudioSource, mVideoSource,
-                                        aNeedsFinish);
+                                        mFinished);
   mMediaThread->Dispatch(runnable, NS_DISPATCH_NORMAL);
 }
 
+// Called from the MediaStreamGraph thread
 void
 GetUserMediaCallbackMediaStreamListener::NotifyFinished(MediaStreamGraph* aGraph)
 {
-  Invalidate(false);
+  mFinished = true;
+  Invalidate(); // we know it's been activated
   NS_DispatchToMainThread(new GetUserMediaListenerRemove(mWindowID, this));
 }
 
+// Called from the MediaStreamGraph thread
+// this can be in response to our own RemoveListener() (via ::Remove()), or
+// because the DOM GC'd the DOMLocalMediaStream/etc we're attached to.
+void
+GetUserMediaCallbackMediaStreamListener::NotifyRemoved(MediaStreamGraph* aGraph)
+{
+  {
+    MutexAutoLock lock(mLock); // protect access to mRemoved
+    MM_LOG(("Listener removed by DOM Destroy(), mFinished = %d", (int) mFinished));
+    mRemoved = true;
+  }
+  if (!mFinished) {
+    NotifyFinished(aGraph);
+  }
+}
+
 } // namespace mozilla
diff --git a/dom/media/MediaManager.h b/dom/media/MediaManager.h
index 6704b38c504b..3cf10fbaafda 100644
--- a/dom/media/MediaManager.h
+++ b/dom/media/MediaManager.h
@@ -73,21 +73,23 @@ public:
   GetUserMediaCallbackMediaStreamListener(nsIThread *aThread,
     uint64_t aWindowID)
     : mMediaThread(aThread)
-    , mWindowID(aWindowID) {}
+    , mWindowID(aWindowID)
+    , mFinished(false)
+    , mLock("mozilla::GUMCMSL")
+    , mRemoved(false) {}
 
   ~GetUserMediaCallbackMediaStreamListener()
   {
-    // It's OK to release mStream and mPort on any thread; they have thread-safe
+    // It's OK to release mStream on any thread; they have thread-safe
     // refcounts.
   }
 
   void Activate(already_AddRefed<SourceMediaStream> aStream,
-    already_AddRefed<MediaInputPort> aPort,
     MediaEngineSource* aAudioSource,
     MediaEngineSource* aVideoSource)
   {
+    NS_ASSERTION(NS_IsMainThread(), "Only call on main thread");
     mStream = aStream; // also serves as IsActive();
-    mPort = aPort;
     mAudioSource = aAudioSource;
     mVideoSource = aVideoSource;
     mLastEndTimeAudio = 0;
@@ -102,25 +104,34 @@ public:
   }
   SourceMediaStream *GetSourceStream()
   {
-    MOZ_ASSERT(mStream);
+    NS_ASSERTION(mStream,"Getting stream from never-activated GUMCMSListener");
+    if (!mStream) {
+      return nullptr;
+    }
     return mStream->AsSourceStream();
   }
 
   // implement in .cpp to avoid circular dependency with MediaOperationRunnable
-  void Invalidate(bool aNeedsFinish);
+  // Can be invoked from EITHER MainThread or MSG thread
+  void Invalidate();
 
   void
   Remove()
   {
     NS_ASSERTION(NS_IsMainThread(), "Only call on main thread");
+    // allow calling even if inactive (!mStream) for easier cleanup
     // Caller holds strong reference to us, so no death grip required
-    if (mStream) // allow even if inactive for easier cleanup
+    MutexAutoLock lock(mLock); // protect access to mRemoved
+    if (mStream && !mRemoved) {
+      MM_LOG(("Listener removed on purpose, mFinished = %d", (int) mFinished));
+      mRemoved = true; // RemoveListener is async, avoid races
       mStream->RemoveListener(this);
+    }
   }
 
   // Proxy NotifyPull() to sources
-  void
-  NotifyPull(MediaStreamGraph* aGraph, StreamTime aDesiredTime)
+  virtual void
+  NotifyPull(MediaStreamGraph* aGraph, StreamTime aDesiredTime) MOZ_OVERRIDE
   {
     // Currently audio sources ignore NotifyPull, but they could
     // watch it especially for fake audio.
@@ -132,18 +143,31 @@ public:
     }
   }
 
-  void
-  NotifyFinished(MediaStreamGraph* aGraph);
+  virtual void
+  NotifyFinished(MediaStreamGraph* aGraph) MOZ_OVERRIDE;
+
+  virtual void
+  NotifyRemoved(MediaStreamGraph* aGraph) MOZ_OVERRIDE;
 
 private:
+  // Set at construction
   nsCOMPtr<nsIThread> mMediaThread;
   uint64_t mWindowID;
-  nsRefPtr<MediaEngineSource> mAudioSource;
-  nsRefPtr<MediaEngineSource> mVideoSource;
-  nsRefPtr<SourceMediaStream> mStream;
-  nsRefPtr<MediaInputPort> mPort;
+
+  // Set at Activate on MainThread
+
+  // Accessed from MediaStreamGraph thread, MediaManager thread, and MainThread
+  // No locking needed as they're only addrefed except on the MediaManager thread
+  nsRefPtr<MediaEngineSource> mAudioSource; // threadsafe refcnt
+  nsRefPtr<MediaEngineSource> mVideoSource; // threadsafe refcnt
+  nsRefPtr<SourceMediaStream> mStream; // threadsafe refcnt
   TrackTicks mLastEndTimeAudio;
   TrackTicks mLastEndTimeVideo;
+  bool mFinished;
+
+  // Accessed from MainThread and MSG thread
+  Mutex mLock; // protects mRemoved access from MainThread
+  bool mRemoved;
 };
 
 typedef enum {
@@ -181,9 +205,8 @@ public:
     SourceMediaStream *source = mListener->GetSourceStream();
     // No locking between these is required as all the callbacks for the
     // same MediaStream will occur on the same thread.
-    MOZ_ASSERT(source);
-    if (!source)  // paranoia
-      return NS_ERROR_FAILURE;
+    if (!source) // means the stream was never Activated()
+      return NS_OK;
 
     switch (mType) {
       case MEDIA_START:
diff --git a/dom/media/PeerConnection.js b/dom/media/PeerConnection.js
index c1b3b771b156..9e4f1d213dcb 100644
--- a/dom/media/PeerConnection.js
+++ b/dom/media/PeerConnection.js
@@ -81,7 +81,7 @@ GlobalPCList.prototype = {
                topic == "network:offline-about-to-go-offline") {
       // Delete all peerconnections on shutdown - synchronously (we need
       // them to be done deleting transports before we return)!
-      // Also kill them if "Work Offline" is selected - more can be created 
+      // Also kill them if "Work Offline" is selected - more can be created
       // while offline, but attempts to connect them should fail.
       let array;
       while ((array = this._list.pop()) != undefined) {
@@ -390,10 +390,6 @@ PeerConnection.prototype = {
   },
 
   setLocalDescription: function(desc, onSuccess, onError) {
-    if (this._onSetLocalDescriptionSuccess) {
-      throw new Error("setLocalDescription already called");
-    }
-
     this._onSetLocalDescriptionSuccess = onSuccess;
     this._onSetLocalDescriptionFailure = onError;
 
@@ -420,10 +416,6 @@ PeerConnection.prototype = {
   },
 
   setRemoteDescription: function(desc, onSuccess, onError) {
-    if (this._onSetRemoteDescriptionSuccess) {
-      throw new Error("setRemoteDescription already called");
-    }
-
     this._onSetRemoteDescriptionSuccess = onSuccess;
     this._onSetRemoteDescriptionFailure = onError;
 
diff --git a/dom/messages/SystemMessageInternal.js b/dom/messages/SystemMessageInternal.js
index 42bd371cf25b..ad452a426685 100644
--- a/dom/messages/SystemMessageInternal.js
+++ b/dom/messages/SystemMessageInternal.js
@@ -168,6 +168,20 @@ SystemMessageInternal.prototype = {
 
   receiveMessage: function receiveMessage(aMessage) {
     let msg = aMessage.json;
+
+    // To prevent the hacked child process from sending commands to parent
+    // to manage system messages, we need to check its manifest URL.
+    if (["SystemMessageManager:Register",
+         "SystemMessageManager:Unregister",
+         "SystemMessageManager:GetPendingMessages",
+         "SystemMessageManager:HasPendingMessages",
+         "SystemMessageManager:Message:Return:OK"].indexOf(aMessage.name) != -1) {
+      if (!aMessage.target.assertContainApp(msg.manifest)) {
+        debug("Got message from a child process containing illegal manifest URL.");
+        return null;
+      }
+    }
+
     switch(aMessage.name) {
       case "SystemMessageManager:AskReadyToRegister":
         return true;
diff --git a/dom/mms/src/ril/MmsService.js b/dom/mms/src/ril/MmsService.js
index 7bd2fbcc810f..a116670f485b 100644
--- a/dom/mms/src/ril/MmsService.js
+++ b/dom/mms/src/ril/MmsService.js
@@ -39,6 +39,7 @@ const CONFIG_SEND_REPORT_DEFAULT_YES = 2;
 const CONFIG_SEND_REPORT_ALWAYS      = 3;
 
 const TIME_TO_BUFFER_MMS_REQUESTS    = 30000;
+const TIME_TO_RELEASE_MMS_CONNECTION = 30000;
 
 XPCOMUtils.defineLazyServiceGetter(this, "gpps",
                                    "@mozilla.org/network/protocol-proxy-service;1",
@@ -129,6 +130,9 @@ MmsService.prototype = {
   mmsRequestQueue: [],
   timerToClearQueue: Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer),
 
+  timerToReleaseMmsConnection: Cc["@mozilla.org/timer;1"].createInstance(Ci.nsITimer),
+  isProxyFilterRegistered: false,
+
   /**
    * Calculate Whether or not should we enable X-Mms-Report-Allowed.
    *
@@ -147,6 +151,20 @@ MmsService.prototype = {
     return config >= CONFIG_SEND_REPORT_DEFAULT_YES;
   },
 
+  /**
+   * Callback when |timerToClearQueue| is timeout or cancelled by shutdown.
+   */
+  timerToClearQueueCb: function timerToClearQueueCb() {
+    debug("timerToClearQueueCb: clear the buffered MMS requests due to " +
+          "the timeout or cancel: number: " + this.mmsRequestQueue.length);
+    while (this.mmsRequestQueue.length) {
+      let mmsRequest = this.mmsRequestQueue.shift();
+      if (mmsRequest.callback) {
+        mmsRequest.callback(0, null);
+      }
+    }
+  },
+
   /**
    * Acquire the MMS network connection.
    *
@@ -176,27 +194,41 @@ MmsService.prototype = {
 
       // Set a timer to clear the buffered MMS requests if the
       // MMS network fails to be connected within a time period.
-      this.timerToClearQueue.initWithCallback(function timerToClearQueueCb() {
-        debug("timerToClearQueueCb: clear the buffered MMS requests due to " +
-              "the timeout: number: " + this.mmsRequestQueue.length);
-        while (this.mmsRequestQueue.length) {
-          let mmsRequest = this.mmsRequestQueue.shift();
-          if (mmsRequest.callback) {
-            mmsRequest.callback(0, null);
-          }
-        }
-      }.bind(this), TIME_TO_BUFFER_MMS_REQUESTS, Ci.nsITimer.TYPE_ONE_SHOT);
+      this.timerToClearQueue.
+        initWithCallback(this.timerToClearQueueCb.bind(this),
+                         TIME_TO_BUFFER_MMS_REQUESTS,
+                         Ci.nsITimer.TYPE_ONE_SHOT);
       return false;
     }
 
-    if (!this.mmsConnRefCount) {
+    if (!this.mmsConnRefCount && !this.isProxyFilterRegistered) {
       debug("acquireMmsConnection: register the MMS proxy filter.");
       gpps.registerFilter(this, 0);
+      this.isProxyFilterRegistered = true;
     }
     this.mmsConnRefCount++;
     return true;
   },
 
+  /**
+   * Callback when |timerToReleaseMmsConnection| is timeout or cancelled by shutdown.
+   */
+  timerToReleaseMmsConnectionCb: function timerToReleaseMmsConnectionCb() {
+    if (this.mmsConnRefCount) {
+      return;
+    }
+
+    debug("timerToReleaseMmsConnectionCb: " +
+          "unregister the MMS proxy filter and deactivate the MMS data call.");
+    if (this.isProxyFilterRegistered) {
+      gpps.unregisterFilter(this);
+      this.isProxyFilterRegistered = false;
+    }
+    if (this.mmsNetworkConnected) {
+      gRIL.deactivateDataCallByType("mms");
+    }
+  },
+
   /**
    * Release the MMS network connection.
    */
@@ -205,10 +237,12 @@ MmsService.prototype = {
     if (this.mmsConnRefCount <= 0) {
       this.mmsConnRefCount = 0;
 
-      debug("releaseMmsConnection: " +
-            "unregister the MMS proxy filter and deactivate the MMS data call.");
-      gpps.unregisterFilter(this);
-      gRIL.deactivateDataCallByType("mms");
+      // Set a timer to delay the release of MMS network connection,
+      // since the MMS requests often come consecutively in a short time.
+      this.timerToReleaseMmsConnection.
+        initWithCallback(this.timerToReleaseMmsConnectionCb.bind(this),
+                         TIME_TO_RELEASE_MMS_CONNECTION,
+                         Ci.nsITimer.TYPE_ONE_SHOT);
     }
   },
 
@@ -711,12 +745,9 @@ MmsService.prototype = {
           Services.prefs.removeObserver(name, this);
         }, this);
         this.timerToClearQueue.cancel();
-        while (this.mmsRequestQueue.length) {
-          let mmsRequest = this.mmsRequestQueue.shift();
-          if (mmsRequest.callback) {
-            mmsRequest.callback(0, null);
-          }
-        }
+        this.timerToClearQueueCb();
+        this.timerToReleaseMmsConnection.cancel();
+        this.timerToReleaseMmsConnectionCb();
         break;
       }
       case kPrefenceChangedObserverTopic: {
diff --git a/dom/network/src/NetworkStatsManager.js b/dom/network/src/NetworkStatsManager.js
index 8266bc2bc12c..f117278abb17 100644
--- a/dom/network/src/NetworkStatsManager.js
+++ b/dom/network/src/NetworkStatsManager.js
@@ -12,6 +12,16 @@ const {classes: Cc, interfaces: Ci, utils: Cu, results: Cr} = Components;
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
 Cu.import("resource://gre/modules/Services.jsm");
 Cu.import("resource://gre/modules/DOMRequestHelper.jsm");
+Cu.import("resource://gre/modules/ObjectWrapper.jsm");
+
+// Ensure NetworkStatsService and NetworkStatsDB are loaded in the parent process
+// to receive messages from the child processes.
+let appInfo = Cc["@mozilla.org/xre/app-info;1"];
+let isParentProcess = !appInfo || appInfo.getService(Ci.nsIXULRuntime)
+                        .processType == Ci.nsIXULRuntime.PROCESS_TYPE_DEFAULT;
+if (isParentProcess) {
+  Cu.import("resource://gre/modules/NetworkStatsService.jsm");
+}
 
 XPCOMUtils.defineLazyServiceGetter(this, "cpmm",
                                    "@mozilla.org/childprocessmessagemanager;1",
@@ -43,14 +53,14 @@ NetworkStatsData.prototype = {
                                      flags: nsIClassInfo.DOM_OBJECT}),
 
   QueryInterface : XPCOMUtils.generateQI([nsIDOMMozNetworkStatsData])
-}
+};
 
 // NetworkStats
 const NETWORKSTATS_CONTRACTID = "@mozilla.org/networkstats;1";
 const NETWORKSTATS_CID        = Components.ID("{037435a6-f563-48f3-99b3-a0106d8ba5bd}");
 const nsIDOMMozNetworkStats   = Components.interfaces.nsIDOMMozNetworkStats;
 
-function NetworkStats(aStats) {
+function NetworkStats(aWindow, aStats) {
   if (DEBUG) {
     debug("NetworkStats Constructor");
   }
@@ -58,11 +68,10 @@ function NetworkStats(aStats) {
   this.start = aStats.start || null;
   this.end = aStats.end || null;
 
-  let samples = [];
+  let samples = this.data = Cu.createArrayIn(aWindow);
   for (let i = 0; i < aStats.data.length; i++) {
     samples.push(new NetworkStatsData(aStats.data[i]));
   }
-  this.data = samples;
 }
 
 NetworkStats.prototype = {
@@ -101,7 +110,7 @@ NetworkStatsManager.prototype = {
 
   checkPrivileges: function checkPrivileges() {
     if (!this.hasPrivileges) {
-      throw Cr.NS_ERROR_NOT_IMPLEMENTED;
+      throw Components.Exception("Permission denied", Cr.NS_ERROR_FAILURE);
     }
   },
 
@@ -133,19 +142,16 @@ NetworkStatsManager.prototype = {
 
   get connectionTypes() {
     this.checkPrivileges();
-
-    return cpmm.sendSyncMessage("NetworkStats:Types")[0];
+    return ObjectWrapper.wrap(cpmm.sendSyncMessage("NetworkStats:Types")[0], this._window);
   },
 
   get sampleRate() {
     this.checkPrivileges();
-
     return cpmm.sendSyncMessage("NetworkStats:SampleRate")[0] / 1000;
   },
 
   get maxStorageSamples() {
     this.checkPrivileges();
-
     return cpmm.sendSyncMessage("NetworkStats:MaxStorageSamples")[0];
   },
 
@@ -170,7 +176,7 @@ NetworkStatsManager.prototype = {
           return;
         }
 
-        let result = new NetworkStats(msg.result);
+        let result = new NetworkStats(this._window, msg.result);
         if (DEBUG) {
           debug("result: " + JSON.stringify(result));
         }
@@ -198,8 +204,6 @@ NetworkStatsManager.prototype = {
     if (!Services.prefs.getBoolPref("dom.mozNetworkStats.enabled")) {
       return null;
     }
-    this.initHelper(aWindow, ["NetworkStats:Get:Return",
-                              "NetworkStats:Clear:Return"]);
 
     let principal = aWindow.document.nodePrincipal;
     let secMan = Services.scriptSecurityManager;
@@ -213,6 +217,13 @@ NetworkStatsManager.prototype = {
     if (DEBUG) {
       debug("has privileges: " + this.hasPrivileges);
     }
+
+    if (!this.hasPrivileges) {
+      return null;
+    }
+
+    this.initHelper(aWindow, ["NetworkStats:Get:Return",
+                              "NetworkStats:Clear:Return"]);
   },
 
   // Called from DOMRequestIpcHelper
@@ -235,4 +246,4 @@ NetworkStatsManager.prototype = {
 
 this.NSGetFactory = XPCOMUtils.generateNSGetFactory([NetworkStatsData,
                                                      NetworkStats,
-                                                     NetworkStatsManager])
+                                                     NetworkStatsManager]);
diff --git a/dom/network/src/NetworkStatsService.jsm b/dom/network/src/NetworkStatsService.jsm
index f13a7effb710..aad44d5d22a5 100644
--- a/dom/network/src/NetworkStatsService.jsm
+++ b/dom/network/src/NetworkStatsService.jsm
@@ -74,6 +74,10 @@ this.NetworkStatsService = {
   },
 
   receiveMessage: function(aMessage) {
+    if (!aMessage.target.assertPermission("networkstats-manage")) {
+      return;
+    }
+
     if (DEBUG) {
       debug("receiveMessage " + aMessage.name);
     }
diff --git a/dom/network/src/TCPSocketParent.cpp b/dom/network/src/TCPSocketParent.cpp
index e1d2a88d9526..99fceff80a0a 100644
--- a/dom/network/src/TCPSocketParent.cpp
+++ b/dom/network/src/TCPSocketParent.cpp
@@ -8,7 +8,7 @@
 #include "nsJSUtils.h"
 #include "nsIDOMTCPSocket.h"
 #include "mozilla/unused.h"
-#include "mozilla/AppProcessPermissions.h"
+#include "mozilla/AppProcessChecker.h"
 
 namespace IPC {
 
diff --git a/dom/network/tests/Makefile.in b/dom/network/tests/Makefile.in
index 3583ac0bfebb..9107eb6051ce 100644
--- a/dom/network/tests/Makefile.in
+++ b/dom/network/tests/Makefile.in
@@ -24,6 +24,9 @@ MOCHITEST_FILES = \
 ifdef MOZ_B2G_RIL
 MOCHITEST_FILES = \
   test_networkstats_basics.html \
+  test_networkstats_disabled.html \
+  test_networkstats_enabled_no_perm.html \
+  test_networkstats_enabled_perm.html \
   $(NULL)
 endif
 
diff --git a/dom/network/tests/test_networkstats_basics.html b/dom/network/tests/test_networkstats_basics.html
index d4103f20f7ae..bac487c290a7 100644
--- a/dom/network/tests/test_networkstats_basics.html
+++ b/dom/network/tests/test_networkstats_basics.html
@@ -12,20 +12,13 @@
 <pre id="test">
 <script type="application/javascript">
 
-/** Test for NetworkStats **/
+// Test for NetworkStats
 function checkInterface(aInterface) {
   ok(!(aInterface in window), aInterface + " should be prefixed");
   ok(("Moz" + aInterface) in window, aInterface + " should be prefixed");
 }
 
 function test() {
-  var gNetworkStatsEnabled = SpecialPowers.getBoolPref("dom.mozNetworkStats.enabled");
-
-  if (!gNetworkStatsEnabled) {
-    is(navigator.mozNetworkStats, null, "mozNetworkStats is null when not enabled.");
-    SimpleTest.finish();
-  }
-
   // Test interfaces
   checkInterface("NetworkStatsManager");
   checkInterface("NetworkStats");
@@ -34,7 +27,6 @@ function test() {
   ok('mozNetworkStats' in navigator, "navigator.mozMozNetworkStats should exist");
   ok(navigator.mozNetworkStats, "navigator.mozNetworkStats returns an object");
 
-  SpecialPowers.addPermission("networkstats-manage", true, document);
   netStats = navigator.mozNetworkStats;
 
   // Test IDL attributes
@@ -279,6 +271,7 @@ var steps = [
   },
   function () {
     ok(true, "all done!\n");
+    SpecialPowers.removePermission("networkstats-manage", document);
     SimpleTest.finish();
     return;
   }
@@ -298,7 +291,9 @@ function next() {
 }
 
 SimpleTest.waitForExplicitFinish();
-addLoadEvent(test);
+
+SpecialPowers.addPermission("networkstats-manage", true, document);
+SpecialPowers.pushPrefEnv({'set': [["dom.mozNetworkStats.enabled", true]]}, test);
 
 </script>
 </pre>
diff --git a/dom/network/tests/test_networkstats_disabled.html b/dom/network/tests/test_networkstats_disabled.html
new file mode 100644
index 000000000000..6cd05c315d3c
--- /dev/null
+++ b/dom/network/tests/test_networkstats_disabled.html
@@ -0,0 +1,31 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test to ensure NetworkStats is not accessible when it is disabled</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+"use strict";
+
+SimpleTest.waitForExplicitFinish();
+
+// Test to ensure NetworkStats is not accessible when it is disabled
+SpecialPowers.pushPrefEnv({'set': [["dom.mozNetworkStats.enabled", false]]}, function(){
+
+  ok('mozNetworkStats' in navigator, "navigator.mozNetworkStats should exist");
+  is(navigator.mozNetworkStats, null, "mozNetworkStats should be null when not enabled.");
+
+  SimpleTest.finish();
+});
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/network/tests/test_networkstats_enabled_no_perm.html b/dom/network/tests/test_networkstats_enabled_no_perm.html
new file mode 100644
index 000000000000..dd911c506a24
--- /dev/null
+++ b/dom/network/tests/test_networkstats_enabled_no_perm.html
@@ -0,0 +1,35 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test to ensure NetworkStats enabled and no networkstats-manage perm does not allow open</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+// Test to ensure NetworkStats is enabled but mozNetworkStats.connectionTypes
+// does not work in content.
+
+SpecialPowers.setBoolPref("dom.mozNetworkStats.enabled", true);
+SpecialPowers.removePermission("networkstats-manage", document);
+
+ok('mozNetworkStats' in navigator, "navigator.mozNetworkStats should be accessible if dom.mozNetworkStats.enabled is true");
+
+var error;
+try {
+  navigator.mozNetworkStats.connectionTypes;
+  ok(false, "Accessing navigator.mozNetworkStats.connectionTypes should have thrown!");
+} catch (ex) {
+  error = ex;
+}
+ok(error, "Got an exception accessing navigator.mozNetworkStats.connectionTypes");
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/network/tests/test_networkstats_enabled_perm.html b/dom/network/tests/test_networkstats_enabled_perm.html
new file mode 100644
index 000000000000..7e24905d99bc
--- /dev/null
+++ b/dom/network/tests/test_networkstats_enabled_perm.html
@@ -0,0 +1,34 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test to ensure NetworkStats is not accessible when it is disabled</title>
+  <script type="application/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none">
+</div>
+<pre id="test">
+<script type="application/javascript">
+
+"use strict";
+
+SimpleTest.waitForExplicitFinish();
+
+// Test to ensure NetworkStats is not accessible when it is disabled
+SpecialPowers.addPermission("networkstats-manage", true, document);
+SpecialPowers.pushPrefEnv({'set': [["dom.mozNetworkStats.enabled", true]]}, function(){
+
+  ok('mozNetworkStats' in navigator, "navigator.mozNetworkStats should exist");
+  ok(navigator.mozNetworkStats instanceof SpecialPowers.Ci.nsIDOMMozNetworkStatsManager,
+      "navigator.mozNetworkStats should be a nsIDOMMozNetworkStatsManager object");
+
+  SpecialPowers.removePermission("networkstats-manage", document);
+  SimpleTest.finish();
+});
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/dom/permission/tests/test_permission_basics.html b/dom/permission/tests/test_permission_basics.html
index 43de203fd079..eef84bdaa4b0 100644
--- a/dom/permission/tests/test_permission_basics.html
+++ b/dom/permission/tests/test_permission_basics.html
@@ -41,7 +41,7 @@ var mozPermissions = window.navigator.mozPermissionSettings;
 
 function permissionTest() {
   // Any permission explicit for privileged and implicit for certified serves
-  var testPerm = "geolocation";
+  var testPerm = "contacts-read";
 
   // Simulate than the app request the permissions
   SpecialPowers.addPermission(testPerm, true, testPrivApp);
diff --git a/dom/settings/SettingsManager.js b/dom/settings/SettingsManager.js
index 8c3fba78b8a1..64f44a295b41 100644
--- a/dom/settings/SettingsManager.js
+++ b/dom/settings/SettingsManager.js
@@ -4,7 +4,7 @@
 
 "use strict";
 
-const DEBUG = true;
+const DEBUG = false;
 function debug(s) {
   if (DEBUG) dump("-*- SettingsManager: " + s + "\n");
 }
diff --git a/dom/settings/SettingsService.js b/dom/settings/SettingsService.js
index 69186317c1cd..2630f771e69b 100644
--- a/dom/settings/SettingsService.js
+++ b/dom/settings/SettingsService.js
@@ -28,8 +28,9 @@ const nsISettingsServiceLock         = Ci.nsISettingsServiceLock;
 
 function SettingsServiceLock(aSettingsService)
 {
-  debug("settingsServiceLock constr!");
+  if (DEBUG) debug("settingsServiceLock constr!");
   this._open = true;
+  this._busy = false;
   this._requests = new Queue();
   this._settingsService = aSettingsService;
   this._transaction = null;
@@ -44,17 +45,21 @@ SettingsServiceLock.prototype = {
     let store = lock._transaction.objectStore(SETTINGSSTORE_NAME);
 
     while (!lock._requests.isEmpty()) {
+      if (lock._isBusy) {
+        return;
+      }
       let info = lock._requests.dequeue();
-      debug("info:" + info.intent);
+      if (DEBUG) debug("info:" + info.intent);
       let callback = info.callback;
-      let req;
       let name = info.name;
       switch (info.intent) {
         case "set":
           let value = info.value;
           let message = info.message;
-          if(typeof(value) == 'object')
+          if(DEBUG && typeof(value) == 'object') {
             debug("object name:" + name + ", val: " + JSON.stringify(value));
+          }
+          lock._isBusy = true;
           let checkKeyRequest = store.get(name);
 
           checkKeyRequest.onsuccess = function (event) {
@@ -63,13 +68,12 @@ SettingsServiceLock.prototype = {
               defaultValue = event.target.result.defaultValue;
             } else {
               defaultValue = null;
-              if (DEBUG) debug("MOZSETTINGS-SET-WARNING: " + key + " is not in the database.\n");
+              if (DEBUG) debug("MOZSETTINGS-SET-WARNING: " + name + " is not in the database.\n");
             }
+            let setReq = store.put({ settingName: name, defaultValue: defaultValue, userValue: value });
 
-            req = store.put({ settingName: name, defaultValue: defaultValue, userValue: value });
-
-            req.onsuccess = function() {
-              if (DEBUG) debug("set on success");
+            setReq.onsuccess = function() {
+              lock._isBusy = false;
               lock._open = true;
               if (callback)
                 callback.handle(name, value);
@@ -79,61 +83,77 @@ SettingsServiceLock.prototype = {
                 message: message
               }));
               lock._open = false;
+              lock.process();
             };
 
-            req.onerror = function(event) { callback ? callback.handleError(event.target.errorMessage) : null; };
+            setReq.onerror = function(event) {
+              lock._isBusy = false;
+              callback ? callback.handleError(event.target.errorMessage) : null;
+              lock.process();
+            };
           }
 
-          checkKeyRequest.onerror = function(event) { callback ? callback.handleError(event.target.errorMessage) : null; };
+          checkKeyRequest.onerror = function(event) {
+            lock._isBusy = false;
+            callback ? callback.handleError(event.target.errorMessage) : null;
+            lock.process();
+          };
           break;
         case "get":
-          req = store.mozGetAll(name);
-          req.onsuccess = function(event) {
-            debug("Request successful. Record count:" + event.target.result.length);
-            debug("result: " + JSON.stringify(event.target.result));
+          let getReq = store.mozGetAll(name);
+          getReq.onsuccess = function(event) {
+            if (DEBUG) {
+              debug("Request successful. Record count:" + event.target.result.length);
+              debug("result: " + JSON.stringify(event.target.result));
+            }
             this._open = true;
             if (callback) {
               if (event.target.result[0]) {
                 if (event.target.result.length > 1) {
-                  debug("Warning: overloaded setting:" + name);
+                  if (DEBUG) debug("Warning: overloaded setting:" + name);
                 }
                 let result = event.target.result[0];
                 let value = result.userValue !== undefined
                             ? result.userValue
                             : result.defaultValue;
                 callback.handle(name, value);
-              } else
+              } else {
                 callback.handle(name, null);
+              }
             } else {
-              debug("no callback defined!");
+              if (DEBUG) debug("no callback defined!");
             }
             this._open = false;
           }.bind(lock);
-          req.onerror = function error(event) { callback ? callback.handleError(event.target.errorMessage) : null; };
+          getReq.onerror = function error(event) { callback ? callback.handleError(event.target.errorMessage) : null; };
           break;
       }
     }
-    if (!lock._requests.isEmpty())
-      throw Components.results.NS_ERROR_ABORT;
     lock._open = true;
   },
 
-  createTransactionAndProcess: function createTransactionAndProcess() {
+  createTransactionAndProcess: function() {
     if (this._settingsService._settingsDB._db) {
-      var lock;
+      let lock;
       while (lock = this._settingsService._locks.dequeue()) {
         if (!lock._transaction) {
           lock._transaction = lock._settingsService._settingsDB._db.transaction(SETTINGSSTORE_NAME, "readwrite");
         }
-        lock.process();
+        if (!lock._isBusy) {
+          lock.process();
+        } else {
+          this._settingsService._locks.enqueue(lock);
+          return;
+        }
       }
-      if (!this._requests.isEmpty())
+      if (!this._requests.isEmpty() && !this._isBusy) {
         this.process();
+      }
     }
   },
 
   get: function get(aName, aCallback) {
-    debug("get: " + aName + ", " + aCallback);
+    if (DEBUG) debug("get: " + aName + ", " + aCallback);
     this._requests.enqueue({ callback: aCallback, intent:"get", name: aName });
     this.createTransactionAndProcess();
   },
@@ -186,12 +206,11 @@ SettingsService.prototype = {
   },
 
   createLock: function createLock() {
-    debug("get lock!");
     var lock = new SettingsServiceLock(this);
     this._locks.enqueue(lock);
     this._settingsDB.ensureDB(
       function() { lock.createTransactionAndProcess(); },
-      function() { dump("ensureDB error cb!\n"); },
+      function() { dump("SettingsService failed to open DB!\n"); },
       myGlobal );
     this.nextTick(function() { this._open = false; }, lock);
     return lock;
diff --git a/dom/system/gonk/RILContentHelper.js b/dom/system/gonk/RILContentHelper.js
index 79e08ed05708..7f4a6b98cdeb 100644
--- a/dom/system/gonk/RILContentHelper.js
+++ b/dom/system/gonk/RILContentHelper.js
@@ -316,26 +316,17 @@ CellBroadcastEtwsInfo.prototype = {
 };
 
 function RILContentHelper() {
-  this.iccInfo = new MobileICCInfo();
-  this.voiceConnectionInfo = new MobileConnectionInfo();
-  this.dataConnectionInfo = new MobileConnectionInfo();
+  this.rilContext = {
+    cardState:            RIL.GECKO_CARDSTATE_UNAVAILABLE,
+    iccInfo:              new MobileICCInfo(),
+    voiceConnectionInfo:  new MobileConnectionInfo(),
+    dataConnectionInfo:   new MobileConnectionInfo()
+  };
   this.voicemailInfo = new VoicemailInfo();
 
   this.initRequests();
   this.initMessageListener(RIL_IPC_MSG_NAMES);
   Services.obs.addObserver(this, "xpcom-shutdown", false);
-
-  // Request initial context.
-  let rilContext = cpmm.sendSyncMessage("RIL:GetRilContext")[0];
-
-  if (!rilContext) {
-    debug("Received null rilContext from chrome process.");
-    return;
-  }
-  this.cardState = rilContext.cardState;
-  this.updateICCInfo(rilContext.icc, this.iccInfo);
-  this.updateConnectionInfo(rilContext.voice, this.voiceConnectionInfo);
-  this.updateConnectionInfo(rilContext.data, this.dataConnectionInfo);
 }
 
 RILContentHelper.prototype = {
@@ -404,12 +395,47 @@ RILContentHelper.prototype = {
 
   // nsIRILContentHelper
 
-  cardState:            RIL.GECKO_CARDSTATE_UNAVAILABLE,
-  iccInfo:              null,
-  voiceConnectionInfo:  null,
-  dataConnectionInfo:   null,
   networkSelectionMode: RIL.GECKO_NETWORK_SELECTION_UNKNOWN,
 
+  rilContext: null,
+
+  getRilContext: function getRilContext() {
+    // Update ril context by sending IPC message to chrome only when the first
+    // time we require it. The information will be updated by following info
+    // changed messages.
+    this.getRilContext = function getRilContext() {
+      return this.rilContext;
+    };
+
+    let rilContext = cpmm.sendSyncMessage("RIL:GetRilContext")[0];
+    if (!rilContext) {
+      debug("Received null rilContext from chrome process.");
+      return;
+    }
+    this.rilContext.cardState = rilContext.cardState;
+    this.updateICCInfo(rilContext.icc, this.rilContext.iccInfo);
+    this.updateConnectionInfo(rilContext.voice, this.rilContext.voiceConnectionInfo);
+    this.updateConnectionInfo(rilContext.data, this.rilContext.dataConnectionInfo);
+
+    return this.rilContext;
+  },
+
+  get iccInfo() {
+    return this.getRilContext().iccInfo;
+  },
+
+  get voiceConnectionInfo() {
+    return this.getRilContext().voiceConnectionInfo;
+  },
+
+  get dataConnectionInfo() {
+    return this.getRilContext().dataConnectionInfo;
+  },
+
+  get cardState() {
+    return this.getRilContext().cardState;
+  },
+
   /**
    * The network that is currently trying to be selected (or "automatic").
    * This helps ensure that only one network is selected at a time.
@@ -457,7 +483,7 @@ RILContentHelper.prototype = {
     let requestId = this.getRequestId(request);
 
     if (this.networkSelectionMode == RIL.GECKO_NETWORK_SELECTION_MANUAL
-        && this.voiceConnectionInfo.network === network) {
+        && this.rilContext.voiceConnectionInfo.network === network) {
 
       // Already manually selected this network, so schedule
       // onsuccess to be fired on the next tick
@@ -876,26 +902,26 @@ RILContentHelper.prototype = {
     debug("Received message '" + msg.name + "': " + JSON.stringify(msg.json));
     switch (msg.name) {
       case "RIL:CardStateChanged":
-        if (this.cardState != msg.json.cardState) {
-          this.cardState = msg.json.cardState;
+        if (this.rilContext.cardState != msg.json.cardState) {
+          this.rilContext.cardState = msg.json.cardState;
           Services.obs.notifyObservers(null, kCardStateChangedTopic, null);
         }
         break;
       case "RIL:IccInfoChanged":
-        this.updateICCInfo(msg.json, this.iccInfo);
-        if (this.iccInfo.mcc) {
+        this.updateICCInfo(msg.json, this.rilContext.iccInfo);
+        if (this.rilContext.iccInfo.mcc) {
           try {
-            Services.prefs.setIntPref("ril.lastKnownMcc", this.iccInfo.mcc);
+            Services.prefs.setIntPref("ril.lastKnownMcc", this.rilContext.iccInfo.mcc);
           } catch (e) {}
         }
         Services.obs.notifyObservers(null, kIccInfoChangedTopic, null);
         break;
       case "RIL:VoiceInfoChanged":
-        this.updateConnectionInfo(msg.json, this.voiceConnectionInfo);
+        this.updateConnectionInfo(msg.json, this.rilContext.voiceConnectionInfo);
         Services.obs.notifyObservers(null, kVoiceChangedTopic, null);
         break;
       case "RIL:DataInfoChanged":
-        this.updateConnectionInfo(msg.json, this.dataConnectionInfo);
+        this.updateConnectionInfo(msg.json, this.rilContext.dataConnectionInfo);
         Services.obs.notifyObservers(null, kDataChangedTopic, null);
         break;
       case "RIL:EnumerateCalls":
@@ -972,7 +998,7 @@ RILContentHelper.prototype = {
         Services.obs.notifyObservers(null, kStkSessionEndTopic, null);
         break;
       case "RIL:DataError":
-        this.updateConnectionInfo(msg.json, this.dataConnectionInfo);
+        this.updateConnectionInfo(msg.json, this.rilContext.dataConnectionInfo);
         Services.obs.notifyObservers(null, kDataErrorTopic, msg.json.error);
         break;
       case "RIL:GetCallForwardingOption":
diff --git a/dom/system/gonk/RadioInterfaceLayer.js b/dom/system/gonk/RadioInterfaceLayer.js
index 2c1c52fc70a7..ab907ef2363d 100644
--- a/dom/system/gonk/RadioInterfaceLayer.js
+++ b/dom/system/gonk/RadioInterfaceLayer.js
@@ -1133,15 +1133,6 @@ RadioInterfaceLayer.prototype = {
       return;
     }
 
-    if (!this.dataCallSettings["enabled"] && this.dataNetworkInterface.connected) {
-      debug("Data call settings: disconnect data call.");
-      this.dataNetworkInterface.disconnect();
-      return;
-    }
-    if (!this.dataCallSettings["enabled"] || this.dataNetworkInterface.connected) {
-      debug("Data call settings: nothing to do.");
-      return;
-    }
     let dataInfo = this.rilContext.data;
     let isRegistered =
       dataInfo.state == RIL.GECKO_MOBILE_CONNECTION_STATE_REGISTERED;
@@ -1152,6 +1143,18 @@ RadioInterfaceLayer.prototype = {
             "or doesn't have data connection.");
       return;
     }
+
+    if (this.dataNetworkInterface.connected &&
+        (!this.dataCallSettings["enabled"] ||
+         (dataInfo.roaming && !this.dataCallSettings["roaming_enabled"]))) {
+      debug("Data call settings: disconnect data call.");
+      this.dataNetworkInterface.disconnect();
+      return;
+    }
+    if (!this.dataCallSettings["enabled"] || this.dataNetworkInterface.connected) {
+      debug("Data call settings: nothing to do.");
+      return;
+    }
     if (dataInfo.roaming && !this.dataCallSettings["roaming_enabled"]) {
       debug("We're roaming, but data roaming is disabled.");
       return;
@@ -1613,7 +1616,8 @@ RadioInterfaceLayer.prototype = {
     this._sendTargetMessage("mobileconnection", "RIL:IccInfoChanged", message);
 
     // If spn becomes available, we should check roaming again.
-    if (!oldIcc.spn && message.spn) {
+    let oldSpn = oldIcc ? oldIcc.spn : null;
+    if (!oldSpn && message.spn) {
       let voice = this.rilContext.voice;
       let data = this.rilContext.data;
       let voiceRoaming = voice.roaming;
diff --git a/dom/system/gonk/SystemWorkerManager.cpp b/dom/system/gonk/SystemWorkerManager.cpp
index e0e3de2fb4bf..094fae35eb3e 100644
--- a/dom/system/gonk/SystemWorkerManager.cpp
+++ b/dom/system/gonk/SystemWorkerManager.cpp
@@ -95,7 +95,7 @@ PostToRIL(JSContext *cx, unsigned argc, jsval *vp)
       return false;
     }
 
-    uint32_t type = JS_GetTypedArrayType(obj);
+    uint32_t type = JS_GetArrayBufferViewType(obj);
     if (type != js::ArrayBufferView::TYPE_INT8 &&
         type != js::ArrayBufferView::TYPE_UINT8 &&
         type != js::ArrayBufferView::TYPE_UINT8_CLAMPED) {
@@ -223,7 +223,7 @@ DoNetdCommand(JSContext *cx, unsigned argc, jsval *vp)
       return false;
     }
 
-    uint32_t type = JS_GetTypedArrayType(obj);
+    uint32_t type = JS_GetArrayBufferViewType(obj);
     if (type != js::ArrayBufferView::TYPE_INT8 &&
         type != js::ArrayBufferView::TYPE_UINT8 &&
         type != js::ArrayBufferView::TYPE_UINT8_CLAMPED) {
diff --git a/dom/telephony/Telephony.cpp b/dom/telephony/Telephony.cpp
index 41b6fc0690b0..5bc5a40cf11b 100644
--- a/dom/telephony/Telephony.cpp
+++ b/dom/telephony/Telephony.cpp
@@ -127,8 +127,13 @@ Telephony::NotifyCallsChanged(TelephonyCall* aCall)
   nsRefPtr<CallEvent> event = CallEvent::Create(aCall);
   NS_ASSERTION(event, "This should never fail!");
 
-  if (aCall->CallState() == nsIRadioInterfaceLayer::CALL_STATE_DIALING) {
+  if (aCall->CallState() == nsIRadioInterfaceLayer::CALL_STATE_DIALING ||
+      aCall->CallState() == nsIRadioInterfaceLayer::CALL_STATE_ALERTING ||
+      aCall->CallState() == nsIRadioInterfaceLayer::CALL_STATE_CONNECTED) {
+    NS_ASSERTION(!mActiveCall, "Already have an active call!");
     mActiveCall = aCall;
+  } else if (mActiveCall && mActiveCall->CallIndex() == aCall->CallIndex()) {
+    mActiveCall = nullptr;
   }
 
   nsresult rv =
@@ -383,18 +388,11 @@ Telephony::CallStateChanged(uint32_t aCallIndex, uint16_t aCallState,
   }
 
   if (modifiedCall) {
-
     // See if this should replace our current active call.
     if (aIsActive) {
-      if (aCallState == nsIRadioInterfaceLayer::CALL_STATE_DISCONNECTED) {
-        mActiveCall = nullptr;
-      } else {
         mActiveCall = modifiedCall;
-      }
-    } else {
-      if (mActiveCall && mActiveCall->CallIndex() == aCallIndex) {
-        mActiveCall = nullptr;
-      }
+    } else if (mActiveCall && mActiveCall->CallIndex() == aCallIndex) {
+      mActiveCall = nullptr;
     }
 
     // Change state.
@@ -403,11 +401,13 @@ Telephony::CallStateChanged(uint32_t aCallIndex, uint16_t aCallState,
     return NS_OK;
   }
 
-  // Didn't know anything about this call before now, could be 'incoming' or
-  // 'dialing' that was placed by others.
-  NS_ASSERTION(aCallState == nsIRadioInterfaceLayer::CALL_STATE_INCOMING ||
-               aCallState == nsIRadioInterfaceLayer::CALL_STATE_DIALING,
-               "Serious logic problem here!");
+  // Didn't know anything about this call before now.
+
+  if (aCallState == nsIRadioInterfaceLayer::CALL_STATE_DISCONNECTED) {
+    // Do nothing since we didn't know anything about it before now and it's
+    // been ended already.
+    return NS_OK;
+  }
 
   nsRefPtr<TelephonyCall> call =
     TelephonyCall::Create(this, aNumber, aCallState, aCallIndex);
@@ -433,24 +433,22 @@ Telephony::EnumerateCallState(uint32_t aCallIndex, uint16_t aCallState,
                               const nsAString& aNumber, bool aIsActive,
                               bool* aContinue)
 {
-#ifdef DEBUG
   // Make sure we don't somehow add duplicates.
   for (uint32_t index = 0; index < mCalls.Length(); index++) {
-    NS_ASSERTION(mCalls[index]->CallIndex() != aCallIndex,
-                 "Something is really wrong here!");
+    nsRefPtr<TelephonyCall>& tempCall = mCalls[index];
+    if (tempCall->CallIndex() == aCallIndex) {
+      // We have the call already. Skip it.
+      *aContinue = true;
+      return NS_OK;
+    }
   }
-#endif
+
   nsRefPtr<TelephonyCall> call =
     TelephonyCall::Create(this, aNumber, aCallState, aCallIndex);
   NS_ASSERTION(call, "This should never fail!");
 
   NS_ASSERTION(mCalls.Contains(call), "Should have auto-added new call!");
 
-  if (aIsActive) {
-    NS_ASSERTION(!mActiveCall, "Already have an active call!");
-    mActiveCall = call;
-  }
-
   *aContinue = true;
   return NS_OK;
 }
diff --git a/dom/tests/browser/browser_bug396843.js b/dom/tests/browser/browser_bug396843.js
index 054f4aa9ffe2..085f36533a5f 100644
--- a/dom/tests/browser/browser_bug396843.js
+++ b/dom/tests/browser/browser_bug396843.js
@@ -42,7 +42,7 @@ function test() {
         HTML_TAG("dfn", "Span")
         HTML_TAG("dir", "Shared")
         HTML_TAG("div", "Div")
-        HTML_TAG("dl", "SharedList")
+        HTML_TAG("dl", "DList")
         HTML_TAG("dt", "Span")
         HTML_TAG("em", "Span")
         HTML_TAG("embed", "SharedObject")
@@ -84,7 +84,7 @@ function test() {
         HTML_TAG("noframes", "Div")
         HTML_TAG("noscript", "Div")
         HTML_TAG("object", "Object")
-        HTML_TAG("ol", "SharedList")
+        HTML_TAG("ol", "OList")
         HTML_TAG("optgroup", "OptGroup")
         HTML_TAG("option", "Option")
         HTML_TAG("p", "Paragraph")
@@ -115,7 +115,7 @@ function test() {
         HTML_TAG("tr", "TableRow")
         HTML_TAG("tt", "Span")
         HTML_TAG("u", "Span")
-        HTML_TAG("ul", "SharedList")
+        HTML_TAG("ul", "UList")
         HTML_TAG("var", "Span")
         HTML_TAG("wbr", "Shared")
         HTML_TAG("xmp", "Span")
diff --git a/dom/tests/mochitest/bugs/test_bug396843.html b/dom/tests/mochitest/bugs/test_bug396843.html
index 55f936ea6c76..bdda2f8bc745 100644
--- a/dom/tests/mochitest/bugs/test_bug396843.html
+++ b/dom/tests/mochitest/bugs/test_bug396843.html
@@ -60,7 +60,7 @@ HTML_TAG("del", "Mod")
 HTML_TAG("dfn", "Span")
 HTML_TAG("dir", "Shared")
 HTML_TAG("div", "Div")
-HTML_TAG("dl", "SharedList")
+HTML_TAG("dl", "DList")
 HTML_TAG("dt", "Span")
 HTML_TAG("em", "Span")
 HTML_TAG("embed", "SharedObject")
@@ -102,7 +102,7 @@ HTML_TAG("noembed", "Div")
 HTML_TAG("noframes", "Div")
 HTML_TAG("noscript", "Div")
 HTML_TAG("object", "Object")
-HTML_TAG("ol", "SharedList")
+HTML_TAG("ol", "OList")
 HTML_TAG("optgroup", "OptGroup")
 HTML_TAG("option", "Option")
 HTML_TAG("p", "Paragraph")
@@ -133,7 +133,7 @@ HTML_TAG("title", "Title")
 HTML_TAG("tr", "TableRow")
 HTML_TAG("tt", "Span")
 HTML_TAG("u", "Span")
-HTML_TAG("ul", "SharedList")
+HTML_TAG("ul", "UList")
 HTML_TAG("var", "Span")
 HTML_TAG("wbr", "Shared")
 HTML_TAG("xmp", "Span")
diff --git a/dom/tests/mochitest/webapps/apps/Makefile.in b/dom/tests/mochitest/webapps/apps/Makefile.in
index 02050a2a386a..b88db945c6e2 100644
--- a/dom/tests/mochitest/webapps/apps/Makefile.in
+++ b/dom/tests/mochitest/webapps/apps/Makefile.in
@@ -34,6 +34,12 @@ MOCHITEST_CHROME_FILES	= \
     invalid_entry_point.webapp^headers^ \
     invalid_locale_entry_point.webapp \
     invalid_locale_entry_point.webapp^headers^ \
+    invalid_activity_href.webapp \
+    invalid_activity_href.webapp^headers^ \
+    invalid_activity_href2.webapp \
+    invalid_activity_href2.webapp^headers^ \
+    invalid_message.webapp \
+    invalid_message.webapp^headers^ \
     launch_paths.webapp \
     launch_paths.webapp^headers^ \
     $(NULL)
diff --git a/dom/tests/mochitest/webapps/apps/basic.webapp b/dom/tests/mochitest/webapps/apps/basic.webapp
index 0677b090f7b1..16204e768a90 100644
--- a/dom/tests/mochitest/webapps/apps/basic.webapp
+++ b/dom/tests/mochitest/webapps/apps/basic.webapp
@@ -1,4 +1,16 @@
 {
   "name": "Basic App",
-  "installs_allowed_from": ["*"]
+  "installs_allowed_from": ["*"],
+  "activities": {
+    "without_href": {
+      "returnValue": true
+    },
+    "valid_href": {
+      "returnvalue": true,
+      "href": "/foo.html"
+    }
+  },
+  "messages": [
+    { "valid_message_href": "/bar.html" }
+  ]
 }
diff --git a/dom/tests/mochitest/webapps/apps/invalid_activity_href.webapp b/dom/tests/mochitest/webapps/apps/invalid_activity_href.webapp
new file mode 100644
index 000000000000..db675dde1285
--- /dev/null
+++ b/dom/tests/mochitest/webapps/apps/invalid_activity_href.webapp
@@ -0,0 +1,14 @@
+{
+  "name": "Absolute Activity Href App",
+  "description": "App with an invalid activity href",
+  "installs_allowed_from": [ "*" ],
+  "activities": {
+    "without_href": { },
+    "absolute_href": {
+      "href": "http://www.mozilla.org"
+    },
+    "valid_href": {
+      "href": "/transfer.html"
+    }
+  }
+}
diff --git a/dom/tests/mochitest/webapps/apps/invalid_activity_href.webapp^headers^ b/dom/tests/mochitest/webapps/apps/invalid_activity_href.webapp^headers^
new file mode 100644
index 000000000000..a2367b11c78b
--- /dev/null
+++ b/dom/tests/mochitest/webapps/apps/invalid_activity_href.webapp^headers^
@@ -0,0 +1 @@
+Content-Type: application/x-web-app-manifest+json
diff --git a/dom/tests/mochitest/webapps/apps/invalid_activity_href2.webapp b/dom/tests/mochitest/webapps/apps/invalid_activity_href2.webapp
new file mode 100644
index 000000000000..5b725816d7af
--- /dev/null
+++ b/dom/tests/mochitest/webapps/apps/invalid_activity_href2.webapp
@@ -0,0 +1,14 @@
+{
+  "name": "data:URI Activity Href App",
+  "description": "App with an invalid activity href",
+  "installs_allowed_from": [ "*" ],
+  "activities": {
+    "without_href": { },
+    "valid_href": {
+      "href": "/transfer.html"
+    },
+    "invalid_href": {
+      "href": "data:text/html;base64,PGh0bWw+DQo8aGVhZD4NCjwvaGVhZD4NCjxib2R5Pg0KPGI+SGFoITwvYj4NCjwvYm9keT4NCjwvaHRtbD4="
+    }
+  }
+}
diff --git a/dom/tests/mochitest/webapps/apps/invalid_activity_href2.webapp^headers^ b/dom/tests/mochitest/webapps/apps/invalid_activity_href2.webapp^headers^
new file mode 100644
index 000000000000..a2367b11c78b
--- /dev/null
+++ b/dom/tests/mochitest/webapps/apps/invalid_activity_href2.webapp^headers^
@@ -0,0 +1 @@
+Content-Type: application/x-web-app-manifest+json
diff --git a/dom/tests/mochitest/webapps/apps/invalid_message.webapp b/dom/tests/mochitest/webapps/apps/invalid_message.webapp
new file mode 100644
index 000000000000..6e90e0b37931
--- /dev/null
+++ b/dom/tests/mochitest/webapps/apps/invalid_message.webapp
@@ -0,0 +1,8 @@
+{
+  "name": "Absolute Message Href App",
+  "description": "App with an invalid message href",
+  "installs_allowed_from": [ "*" ],
+  "messages": [
+    { "absolute_href": "http://www.mozilla.org" }
+  ]
+}
diff --git a/dom/tests/mochitest/webapps/apps/invalid_message.webapp^headers^ b/dom/tests/mochitest/webapps/apps/invalid_message.webapp^headers^
new file mode 100644
index 000000000000..a2367b11c78b
--- /dev/null
+++ b/dom/tests/mochitest/webapps/apps/invalid_message.webapp^headers^
@@ -0,0 +1 @@
+Content-Type: application/x-web-app-manifest+json
diff --git a/dom/tests/mochitest/webapps/test_install_errors.xul b/dom/tests/mochitest/webapps/test_install_errors.xul
index 2d436433afbd..f44eff4501fd 100644
--- a/dom/tests/mochitest/webapps/test_install_errors.xul
+++ b/dom/tests/mochitest/webapps/test_install_errors.xul
@@ -29,6 +29,9 @@ var steps = [
   invalidLaunchPath2,
   invalidEntryPoint,
   invalidLocaleEntryPoint,
+  invalidActivityHref,
+  invalidActivityHref2,
+  invalidMessage,
   fileURL,
   originNotAllowed,
   originAllowed,
@@ -144,6 +147,36 @@ function invalidLocaleEntryPoint(next) {
   };
 }
 
+function invalidActivityHref(next) {
+  var url = "http://test/chrome/dom/tests/mochitest/webapps/apps/invalid_activity_href.webapp";
+
+  confirmNextInstall();
+  navigator.mozApps.install(url, null).onerror = function onInstallError() {
+    is(this.error.name, "INVALID_MANIFEST", "Manifest has non-relative URI for activity href");
+    next();
+  };
+}
+
+function invalidActivityHref2(next) {
+  var url = "http://test/chrome/dom/tests/mochitest/webapps/apps/invalid_activity_href2.webapp";
+
+  confirmNextInstall();
+  navigator.mozApps.install(url, null).onerror = function onInstallError() {
+    is(this.error.name, "INVALID_MANIFEST", "Manifest has data: URI for activity href");
+    next();
+  };
+}
+
+function invalidMessage(next) {
+  var url = "http://test/chrome/dom/tests/mochitest/webapps/apps/invalid_message.webapp";
+
+  confirmNextInstall();
+  navigator.mozApps.install(url, null).onerror = function onInstallError() {
+    is(this.error.name, "INVALID_MANIFEST", "Manifest has absolute message href");
+    next();
+  };
+}
+
 function installPackageNotImplemented(next) {
   ok(!("installPackage" in navigator.mozApps),
      "installPackage not in navigator.mozApps");
diff --git a/dom/webidl/CDATASection.webidl b/dom/webidl/CDATASection.webidl
new file mode 100644
index 000000000000..895dae0894cf
--- /dev/null
+++ b/dom/webidl/CDATASection.webidl
@@ -0,0 +1,8 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+interface CDATASection : Text {
+};
diff --git a/dom/webidl/Document.webidl b/dom/webidl/Document.webidl
index 973a52d3d5b9..70657e68e8be 100644
--- a/dom/webidl/Document.webidl
+++ b/dom/webidl/Document.webidl
@@ -16,10 +16,8 @@
  */
 
 interface Attr;
-interface CDATASection;
 interface Comment;
 interface NodeIterator;
-interface ProcessingInstruction;
 interface Range;
 interface StyleSheetList;
 interface Touch;
@@ -376,7 +374,8 @@ http://dev.w3.org/csswg/cssom-view/#extensions-to-the-document-interface
 partial interface Document {
 */
     Element? elementFromPoint (float x, float y);
-    //(Not implemented)CaretPosition? caretPositionFromPoint (float x, float y);
+
+    CaretPosition? caretPositionFromPoint (float x, float y);
 /*
 };
 
diff --git a/dom/webidl/SVGFitToViewBox.webidl b/dom/webidl/SVGFitToViewBox.webidl
new file mode 100644
index 000000000000..7b8450cd5ff9
--- /dev/null
+++ b/dom/webidl/SVGFitToViewBox.webidl
@@ -0,0 +1,20 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://www.w3.org/TR/SVG2/
+ *
+ * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
+ * liability, trademark and document use rules apply.
+ */
+
+interface SVGAnimatedRect;
+
+[NoInterfaceObject]
+interface SVGFitToViewBox {
+  readonly attribute SVGAnimatedRect viewBox;
+  readonly attribute SVGAnimatedPreserveAspectRatio preserveAspectRatio;
+};
+
diff --git a/dom/webidl/SVGStyleElement.webidl b/dom/webidl/SVGStyleElement.webidl
index 07f6f3c5a691..be560e592e8d 100644
--- a/dom/webidl/SVGStyleElement.webidl
+++ b/dom/webidl/SVGStyleElement.webidl
@@ -19,5 +19,7 @@ interface SVGStyleElement : SVGElement {
   attribute DOMString media;
   [SetterThrows]
   attribute DOMString title;
+  [SetterThrows]
+  attribute boolean scoped;
 };
 
diff --git a/dom/webidl/SVGViewElement.webidl b/dom/webidl/SVGViewElement.webidl
new file mode 100644
index 000000000000..b28b9b4fb5e9
--- /dev/null
+++ b/dom/webidl/SVGViewElement.webidl
@@ -0,0 +1,21 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://www.w3.org/TR/SVG2/
+ *
+ * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
+ * liability, trademark and document use rules apply.
+ */
+
+interface SVGStringList;
+
+interface SVGViewElement : SVGElement {
+  readonly attribute SVGStringList viewTarget;
+};
+
+SVGViewElement implements SVGFitToViewBox;
+SVGViewElement implements SVGZoomAndPan;
+
diff --git a/dom/webidl/SVGZoomAndPan.webidl b/dom/webidl/SVGZoomAndPan.webidl
new file mode 100644
index 000000000000..05bc4fdeb922
--- /dev/null
+++ b/dom/webidl/SVGZoomAndPan.webidl
@@ -0,0 +1,24 @@
+/* -*- Mode: IDL; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this file,
+ * You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * The origin of this IDL file is
+ * http://www.w3.org/TR/SVG2/
+ *
+ * Copyright © 2012 W3C® (MIT, ERCIM, Keio), All Rights Reserved. W3C
+ * liability, trademark and document use rules apply.
+ */
+
+[NoInterfaceObject]
+interface SVGZoomAndPan {
+
+  // Zoom and Pan Types
+  const unsigned short SVG_ZOOMANDPAN_UNKNOWN = 0;
+  const unsigned short SVG_ZOOMANDPAN_DISABLE = 1;
+  const unsigned short SVG_ZOOMANDPAN_MAGNIFY = 2;
+
+  [SetterThrows]
+  attribute unsigned short zoomAndPan;
+};
+
diff --git a/dom/webidl/WebIDL.mk b/dom/webidl/WebIDL.mk
index e65b317f4ce2..b119a1b78164 100644
--- a/dom/webidl/WebIDL.mk
+++ b/dom/webidl/WebIDL.mk
@@ -21,6 +21,7 @@ webidl_files = \
   Blob.webidl \
   CanvasRenderingContext2D.webidl \
   CaretPosition.webidl \
+  CDATASection.webidl \
   CharacterData.webidl \
   ClientRectList.webidl \
   Comment.webidl \
@@ -93,6 +94,7 @@ webidl_files = \
   Performance.webidl \
   PerformanceNavigation.webidl \
   PerformanceTiming.webidl \
+  ProcessingInstruction.webidl \
   Rect.webidl \
   RGBColor.webidl \
   Screen.webidl \
@@ -114,6 +116,7 @@ webidl_files = \
   SVGDescElement.webidl \
   SVGElement.webidl \
   SVGEllipseElement.webidl \
+  SVGFitToViewBox.webidl \
   SVGForeignObjectElement.webidl \
   SVGGElement.webidl \
   SVGGraphicsElement.webidl \
@@ -149,6 +152,8 @@ webidl_files = \
   SVGTransformList.webidl \
   SVGTSpanElement.webidl \
   SVGURIReference.webidl \
+  SVGViewElement.webidl \
+  SVGZoomAndPan.webidl \
   Text.webidl \
   TextDecoder.webidl \
   TextEncoder.webidl \
diff --git a/dom/wifi/WifiWorker.js b/dom/wifi/WifiWorker.js
index 63b00218449f..b0f8514dc9e3 100644
--- a/dom/wifi/WifiWorker.js
+++ b/dom/wifi/WifiWorker.js
@@ -2427,7 +2427,11 @@ WifiWorker.prototype = {
       return;
     }
 
+    let sent = false;
     let callback = (function (networks) {
+      if (sent)
+        return;
+      sent = true;
       this._sendMessage(message, networks !== null, networks, msg);
     }).bind(this);
     this.waitForScan(callback);
@@ -2438,10 +2442,12 @@ WifiWorker.prototype = {
         return;
 
       // Avoid sending multiple responses.
-      this.wantScanResults.splice(this.wantScanResults.indexOf(callback), 1);
+      if (sent)
+        return;
 
       // Otherwise, let the client know that it failed, it's responsible for
       // trying again in a few seconds.
+      sent = true;
       this._sendMessage(message, false, "ScanFailed", msg);
     }).bind(this));
   },
diff --git a/dom/workers/RuntimeService.cpp b/dom/workers/RuntimeService.cpp
index 0fc13112554d..db1f299f3982 100644
--- a/dom/workers/RuntimeService.cpp
+++ b/dom/workers/RuntimeService.cpp
@@ -389,6 +389,14 @@ CTypesActivityCallback(JSContext* aCx,
       worker->EndCTypesCall();
       break;
 
+    case js::CTYPES_CALLBACK_BEGIN:
+      worker->BeginCTypesCallback();
+      break;
+
+    case js::CTYPES_CALLBACK_END:
+      worker->EndCTypesCallback();
+      break;
+
     default:
       MOZ_NOT_REACHED("Unknown type flag!");
   }
@@ -434,7 +442,7 @@ CreateJSContextForWorker(WorkerPrivate* aWorkerPrivate)
     return nullptr;
   }
 
-  JS_SetContextPrivate(workerCx, aWorkerPrivate);
+  JS_SetRuntimePrivate(runtime, aWorkerPrivate);
 
   JS_SetErrorReporter(workerCx, ErrorReporter);
 
diff --git a/dom/workers/WorkerPrivate.cpp b/dom/workers/WorkerPrivate.cpp
index c3ff5c62d0e1..1355f8a94b42 100644
--- a/dom/workers/WorkerPrivate.cpp
+++ b/dom/workers/WorkerPrivate.cpp
@@ -6,7 +6,6 @@
 
 #include "WorkerPrivate.h"
 
-#include "mozIThirdPartyUtil.h"
 #include "nsIClassInfo.h"
 #include "nsIContentSecurityPolicy.h"
 #include "nsIConsoleService.h"
@@ -2476,41 +2475,36 @@ WorkerPrivate::Create(JSContext* aCx, JSObject* aObj, WorkerPrivate* aParent,
           return nullptr;
         }
 
-        nsCOMPtr<nsIURI> codebase;
-        if (NS_FAILED(principal->GetURI(getter_AddRefs(codebase)))) {
-          JS_ReportError(aCx, "Could not determine codebase!");
-          return nullptr;
-        }
+        // We use the document's base domain to limit the number of workers
+        // each domain can create. For sandboxed documents, we use the domain
+        // of their first non-sandboxed document, walking up until we find
+        // one. If we can't find one, we fall back to using the GUID of the
+        // null principal as the base domain.
+        if (document->GetSandboxFlags() & SANDBOXED_ORIGIN) {
+          nsCOMPtr<nsIDocument> tmpDoc = document;
+          do {
+            tmpDoc = tmpDoc->GetParentDocument();
+          } while (tmpDoc && tmpDoc->GetSandboxFlags() & SANDBOXED_ORIGIN);
 
-        NS_NAMED_LITERAL_CSTRING(file, "file");
+          if (tmpDoc) {
+            // There was an unsandboxed ancestor, yay!
+            nsCOMPtr<nsIPrincipal> tmpPrincipal = tmpDoc->NodePrincipal();
 
-        bool isFile;
-        if (NS_FAILED(codebase->SchemeIs(file.get(), &isFile))) {
-          JS_ReportError(aCx, "Could not determine if codebase is file!");
-          return nullptr;
-        }
-
-        if (isFile) {
-          // XXX Fix this, need a real domain here.
-          domain = file;
-        }
-        // Workaround for workers needing a string domain - will be fixed
-        // in a followup after this lands.
-        else if (document->GetSandboxFlags() & SANDBOXED_ORIGIN) {
-          if (NS_FAILED(codebase->GetAsciiSpec(domain))) {
-            JS_ReportError(aCx, "Could not get URI's spec for sandboxed document!");
-            return nullptr;
+            if (NS_FAILED(tmpPrincipal->GetBaseDomain(domain))) {
+              JS_ReportError(aCx, "Could not determine base domain!");
+              return nullptr;
+            }
+          } else {
+            // No unsandboxed ancestor, use our GUID.
+            if (NS_FAILED(principal->GetBaseDomain(domain))) {
+              JS_ReportError(aCx, "Could not determine base domain!");
+             return nullptr;
+            }
           }
         } else {
-          nsCOMPtr<mozIThirdPartyUtil> thirdPartyUtil =
-            do_GetService(THIRDPARTYUTIL_CONTRACTID);
-          if (!thirdPartyUtil) {
-            JS_ReportError(aCx, "Could not get third party helper service!");
-            return nullptr;
-          }
-
-          if (NS_FAILED(thirdPartyUtil->GetBaseDomain(codebase, domain))) {
-            JS_ReportError(aCx, "Could not get domain!");
+          // Document creating the worker is not sandboxed.
+          if (NS_FAILED(principal->GetBaseDomain(domain))) {
+            JS_ReportError(aCx, "Could not determine base domain!");
             return nullptr;
           }
         }
@@ -4200,7 +4194,7 @@ WorkerPrivate*
 GetWorkerPrivateFromContext(JSContext* aCx)
 {
   NS_ASSERTION(!NS_IsMainThread(), "Wrong thread!");
-  return static_cast<WorkerPrivate*>(JS_GetContextPrivate(aCx));
+  return static_cast<WorkerPrivate*>(JS_GetRuntimePrivate(JS_GetRuntime(aCx)));
 }
 
 JSStructuredCloneCallbacks*
diff --git a/dom/workers/WorkerPrivate.h b/dom/workers/WorkerPrivate.h
index 50a66bebbb2a..1d7ef757ffe7 100644
--- a/dom/workers/WorkerPrivate.h
+++ b/dom/workers/WorkerPrivate.h
@@ -771,6 +771,22 @@ public:
   void
   EndCTypesCall();
 
+  void
+  BeginCTypesCallback()
+  {
+    // If a callback is beginning then we need to do the exact same thing as
+    // when a ctypes call ends.
+    EndCTypesCall();
+  }
+
+  void
+  EndCTypesCallback()
+  {
+    // If a callback is ending then we need to do the exact same thing as
+    // when a ctypes call begins.
+    BeginCTypesCall();
+  }
+
 private:
   WorkerPrivate(JSContext* aCx, JSObject* aObject, WorkerPrivate* aParent,
                 JSContext* aParentJSContext, const nsAString& aScriptURL,
diff --git a/dom/workers/WorkerScope.cpp b/dom/workers/WorkerScope.cpp
index addb62695c90..3b6281642d2c 100644
--- a/dom/workers/WorkerScope.cpp
+++ b/dom/workers/WorkerScope.cpp
@@ -963,14 +963,12 @@ CreateDedicatedWorkerGlobalScope(JSContext* aCx)
     return NULL;
   }
 
-  if (worker->IsChromeWorker() &&
-      (!chromeworker::InitClass(aCx, global, workerProto, false) ||
-       !DefineChromeWorkerFunctions(aCx, global))) {
-    return NULL;
-  }
-
-  if (!DefineOSFileConstants(aCx, global)) {
-    return NULL;
+  if (worker->IsChromeWorker()) {
+    if (!chromeworker::InitClass(aCx, global, workerProto, false) ||
+        !DefineChromeWorkerFunctions(aCx, global) ||
+        !DefineOSFileConstants(aCx, global)) {
+      return NULL;
+    }
   }
 
   // Init other classes we care about.
diff --git a/dom/workers/test/Makefile.in b/dom/workers/test/Makefile.in
index 2d17669c6dc1..0dad540ac207 100644
--- a/dom/workers/test/Makefile.in
+++ b/dom/workers/test/Makefile.in
@@ -106,6 +106,8 @@ MOCHITEST_FILES = \
   transferable_worker.js \
   test_errorwarning.html \
   errorwarning_worker.js \
+  test_contentWorker.html \
+  content_worker.js \
   $(NULL)
 
 _SUBDIRMOCHITEST_FILES = \
diff --git a/dom/workers/test/content_worker.js b/dom/workers/test/content_worker.js
new file mode 100644
index 000000000000..7e092ec8c6c9
--- /dev/null
+++ b/dom/workers/test/content_worker.js
@@ -0,0 +1,12 @@
+/**
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/
+ */
+var props = {
+  'ctypes': 1,
+  'OS': 1
+};
+for (var prop in props) {
+  postMessage({ "prop": prop, "value": self[prop] });
+}
+postMessage({ "testfinished": 1 });
diff --git a/dom/workers/test/test_contentWorker.html b/dom/workers/test/test_contentWorker.html
new file mode 100644
index 000000000000..e745ca4a0fd9
--- /dev/null
+++ b/dom/workers/test/test_contentWorker.html
@@ -0,0 +1,48 @@
+<!--
+  Any copyright is dedicated to the Public Domain.
+  http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Test for DOM Worker privileged properties</title>
+  <script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
+  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
+</head>
+<body>
+<p id="display"></p>
+<div id="content" style="display: none">
+
+</div>
+<pre id="test">
+<script class="testbody" language="javascript">
+
+  var workerFilename = "content_worker.js";
+  var worker = new Worker(workerFilename);
+
+  var props = {
+    'ctypes': 1,
+    'OS': 1
+  };
+
+  worker.onmessage = function(event) {
+    if (event.data.testfinished) {
+      SimpleTest.finish();
+      return;
+    }
+    var prop = event.data.prop;
+    ok(prop in props, "checking " + prop);
+    is(event.data.value, undefined, prop + " should be undefined");
+  };
+
+  worker.onerror = function(event) {
+    ok(false, "Worker had an error: " + event.message);
+    SimpleTest.finish();
+  }
+
+  SimpleTest.waitForExplicitFinish();
+
+</script>
+</pre>
+</body>
+</html>
diff --git a/embedding/browser/webBrowser/Makefile.in b/embedding/browser/webBrowser/Makefile.in
index ed101c9f0da1..8ef33a09d1fa 100644
--- a/embedding/browser/webBrowser/Makefile.in
+++ b/embedding/browser/webBrowser/Makefile.in
@@ -24,6 +24,7 @@ EXPORTS         = \
 
 LOCAL_INCLUDES	= \
 		-I$(srcdir)/../../../content/base/src \
+		-I$(srcdir)/../../../content/svg/content/src \
 		$(NULL)
 		
 SDK_XPIDLSRCS   = \
diff --git a/embedding/browser/webBrowser/nsDocShellTreeOwner.cpp b/embedding/browser/webBrowser/nsDocShellTreeOwner.cpp
index 2678deaeb555..d54f45880f5b 100644
--- a/embedding/browser/webBrowser/nsDocShellTreeOwner.cpp
+++ b/embedding/browser/webBrowser/nsDocShellTreeOwner.cpp
@@ -33,7 +33,7 @@
 #include "nsIDOMElement.h"
 #include "Link.h"
 #include "mozilla/dom/Element.h"
-#include "nsIDOMSVGTitleElement.h"
+#include "mozilla/dom/SVGTitleElement.h"
 #include "nsIDOMEvent.h"
 #include "nsIDOMMouseEvent.h"
 #include "nsIFormControl.h"
@@ -1028,9 +1028,11 @@ DefaultTooltipTextProvider::GetNodeText(nsIDOMNode *aNode, PRUnichar **aText,
 {
   NS_ENSURE_ARG_POINTER(aNode);
   NS_ENSURE_ARG_POINTER(aText);
-    
+
   nsString outText;
 
+  nsCOMPtr<nsINode> node = do_QueryInterface(aNode);
+
   bool lookingForSVGTitle = true;
   bool found = false;
   nsCOMPtr<nsIDOMNode> current ( aNode );
@@ -1087,16 +1089,12 @@ DefaultTooltipTextProvider::GetNodeText(nsIDOMNode *aNode, PRUnichar **aText,
                 lookingForSVGTitle = UseSVGTitle(currElement);
               }
               if (lookingForSVGTitle) {
-                nsCOMPtr<nsIDOMNodeList>childNodes;
-                aNode->GetChildNodes(getter_AddRefs(childNodes));
-                uint32_t childNodeCount;
-                childNodes->GetLength(&childNodeCount);
+                nsINodeList* childNodes = node->ChildNodes();
+                uint32_t childNodeCount = childNodes->Length();
                 for (uint32_t i = 0; i < childNodeCount; i++) {
-                  nsCOMPtr<nsIDOMNode>childNode;
-                  childNodes->Item(i, getter_AddRefs(childNode));
-                  nsCOMPtr<nsIDOMSVGTitleElement> titleElement(do_QueryInterface(childNode));
-                  if (titleElement) {
-                    titleElement->GetTextContent(outText);
+                  nsIContent* child = childNodes->Item(i);
+                  if (child->IsSVG(nsGkAtoms::title)) {
+                    static_cast<dom::SVGTitleElement*>(child)->GetTextContent(outText);
                     if ( outText.Length() )
                       found = true;
                     break;
@@ -1108,7 +1106,7 @@ DefaultTooltipTextProvider::GetNodeText(nsIDOMNode *aNode, PRUnichar **aText,
         }
       }
     }
-    
+
     // not found here, walk up to the parent and keep trying
     if ( !found ) {
       nsCOMPtr<nsIDOMNode> temp ( current );
diff --git a/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp b/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp
index 4ec6aa9a8330..4965e011945d 100644
--- a/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp
+++ b/embedding/components/webbrowserpersist/src/nsWebBrowserPersist.cpp
@@ -73,8 +73,6 @@
 #include "nsIDOMHTMLOptionElement.h"
 #include "nsIDOMHTMLTextAreaElement.h"
 #include "nsIDOMHTMLDocument.h"
-#include "nsIDOMSVGImageElement.h"
-#include "nsIDOMSVGScriptElement.h"
 #ifdef MOZ_MEDIA
 #include "nsIDOMHTMLSourceElement.h"
 #include "nsIDOMHTMLMediaElement.h"
@@ -2700,6 +2698,12 @@ nsresult nsWebBrowserPersist::OnWalkDOMNode(nsIDOMNode *aNode)
         return NS_OK;
     }
 
+    nsCOMPtr<nsIContent> content = do_QueryInterface(aNode);
+    if (!content)
+    {
+        return NS_OK;
+    }
+
     // Test the node to see if it's an image, frame, iframe, css, js
     nsCOMPtr<nsIDOMHTMLImageElement> nodeAsImage = do_QueryInterface(aNode);
     if (nodeAsImage)
@@ -2708,8 +2712,7 @@ nsresult nsWebBrowserPersist::OnWalkDOMNode(nsIDOMNode *aNode)
         return NS_OK;
     }
 
-    nsCOMPtr<nsIDOMSVGImageElement> nodeAsSVGImage = do_QueryInterface(aNode);
-    if (nodeAsSVGImage)
+    if (content->IsSVG(nsGkAtoms::img))
     {
         StoreURIAttributeNS(aNode, "http://www.w3.org/1999/xlink", "href");
         return NS_OK;
@@ -2765,8 +2768,7 @@ nsresult nsWebBrowserPersist::OnWalkDOMNode(nsIDOMNode *aNode)
         return NS_OK;
     }
 
-    nsCOMPtr<nsIDOMSVGScriptElement> nodeAsSVGScript = do_QueryInterface(aNode);
-    if (nodeAsSVGScript)
+    if (content->IsSVG(nsGkAtoms::script))
     {
         StoreURIAttributeNS(aNode, "http://www.w3.org/1999/xlink", "href");
         return NS_OK;
@@ -2991,6 +2993,12 @@ nsWebBrowserPersist::CloneNodeWithFixedUpAttributes(
         }
     }
 
+    nsCOMPtr<nsIContent> content = do_QueryInterface(aNodeIn);
+    if (!content)
+    {
+        return NS_OK;
+    }
+
     // Fix up href and file links in the elements
 
     nsCOMPtr<nsIDOMHTMLAnchorElement> nodeAsAnchor = do_QueryInterface(aNodeIn);
@@ -3103,8 +3111,7 @@ nsWebBrowserPersist::CloneNodeWithFixedUpAttributes(
     }
 #endif // MOZ_MEDIA
 
-    nsCOMPtr<nsIDOMSVGImageElement> nodeAsSVGImage = do_QueryInterface(aNodeIn);
-    if (nodeAsSVGImage)
+    if (content->IsSVG(nsGkAtoms::img))
     {
         rv = GetNodeToFixup(aNodeIn, aNodeOut);
         if (NS_SUCCEEDED(rv) && *aNodeOut)
@@ -3132,8 +3139,7 @@ nsWebBrowserPersist::CloneNodeWithFixedUpAttributes(
         return rv;
     }
 
-    nsCOMPtr<nsIDOMSVGScriptElement> nodeAsSVGScript = do_QueryInterface(aNodeIn);
-    if (nodeAsSVGScript)
+    if (content->IsSVG(nsGkAtoms::script))
     {
         rv = GetNodeToFixup(aNodeIn, aNodeOut);
         if (NS_SUCCEEDED(rv) && *aNodeOut)
diff --git a/extensions/cookie/nsPermissionManager.cpp b/extensions/cookie/nsPermissionManager.cpp
index b45d264d60b4..72de9c382dbc 100644
--- a/extensions/cookie/nsPermissionManager.cpp
+++ b/extensions/cookie/nsPermissionManager.cpp
@@ -755,14 +755,20 @@ nsPermissionManager::AddInternal(nsIPrincipal* aPrincipal,
       id = entry->GetPermissions()[index].mID;
 
       // If the new expireType is EXPIRE_SESSION, then we have to keep a
-      // copy of the previous permission value. This cached value will be
+      // copy of the previous permission/expireType values. This cached value will be
       // used when restoring the permissions of an app.
       if (entry->GetPermissions()[index].mExpireType != nsIPermissionManager::EXPIRE_SESSION &&
           aExpireType == nsIPermissionManager::EXPIRE_SESSION) {
         entry->GetPermissions()[index].mNonSessionPermission = entry->GetPermissions()[index].mPermission;
+        entry->GetPermissions()[index].mNonSessionExpireType = entry->GetPermissions()[index].mExpireType;
+      } else if (aExpireType != nsIPermissionManager::EXPIRE_SESSION) {
+        entry->GetPermissions()[index].mNonSessionPermission = aPermission;
+        entry->GetPermissions()[index].mNonSessionExpireType = aExpireType;
+        entry->GetPermissions()[index].mExpireTime = aExpireTime;
       }
 
       entry->GetPermissions()[index].mPermission = aPermission;
+      entry->GetPermissions()[index].mExpireType = aExpireType;
 
       if (aDBOperation == eWriteToDB && aExpireType != nsIPermissionManager::EXPIRE_SESSION)
         // We care only about the id, the permission and expireType/expireTime here.
@@ -1225,7 +1231,11 @@ nsPermissionManager::RemoveExpiredPermissionsForAppEnumerator(
     }
 
     nsPermissionManager::PermissionEntry& permEntry = entry->GetPermissions()[i];
-    if (permEntry.mExpireType == nsIPermissionManager::EXPIRE_SESSION) {
+    if (permEntry.mExpireType != nsIPermissionManager::EXPIRE_SESSION) {
+      continue;
+    }
+
+    if (permEntry.mNonSessionExpireType == nsIPermissionManager::EXPIRE_SESSION) {
       PermissionEntry oldPermissionEntry = entry->GetPermissions()[i];
 
       entry->GetPermissions().RemoveElementAt(i);
@@ -1242,18 +1252,17 @@ nsPermissionManager::RemoveExpiredPermissionsForAppEnumerator(
       continue;
     }
 
-    if (permEntry.mNonSessionPermission != permEntry.mPermission) {
-      permEntry.mPermission = permEntry.mNonSessionPermission;
+    permEntry.mPermission = permEntry.mNonSessionPermission;
+    permEntry.mExpireType = permEntry.mNonSessionExpireType;
 
-      gPermissionManager->NotifyObserversWithPermission(entry->GetKey()->mHost,
-                                                        entry->GetKey()->mAppId,
-                                                        entry->GetKey()->mIsInBrowserElement,
-                                                        gPermissionManager->mTypeArray.ElementAt(permEntry.mType),
-                                                        permEntry.mPermission,
-                                                        permEntry.mExpireType,
-                                                        permEntry.mExpireTime,
-                                                        NS_LITERAL_STRING("changed").get());
-    }
+    gPermissionManager->NotifyObserversWithPermission(entry->GetKey()->mHost,
+                                                      entry->GetKey()->mAppId,
+                                                      entry->GetKey()->mIsInBrowserElement,
+                                                      gPermissionManager->mTypeArray.ElementAt(permEntry.mType),
+                                                      permEntry.mPermission,
+                                                      permEntry.mExpireType,
+                                                      permEntry.mExpireTime,
+                                                      NS_LITERAL_STRING("changed").get());
   }
 
   return PL_DHASH_NEXT;
diff --git a/extensions/cookie/nsPermissionManager.h b/extensions/cookie/nsPermissionManager.h
index bb9dc18f2598..f5bdcedae7e9 100644
--- a/extensions/cookie/nsPermissionManager.h
+++ b/extensions/cookie/nsPermissionManager.h
@@ -44,6 +44,7 @@ public:
      , mExpireType(aExpireType)
      , mExpireTime(aExpireTime)
      , mNonSessionPermission(aPermission)
+     , mNonSessionExpireType(aExpireType)
     {}
 
     int64_t  mID;
@@ -52,6 +53,7 @@ public:
     uint32_t mExpireType;
     int64_t  mExpireTime;
     uint32_t mNonSessionPermission;
+    uint32_t mNonSessionExpireType;
   };
 
   /**
diff --git a/gfx/cairo/README b/gfx/cairo/README
index 2ac84fdbaad5..38aefb1b0441 100644
--- a/gfx/cairo/README
+++ b/gfx/cairo/README
@@ -198,6 +198,10 @@ dwrite-font-match-robustness.patch: bug 717178, don't crash when _name_tables_ma
 
 handle-multi-path-clip.patch: bug 813124, handle multiple clip paths correctly
 
+win32-gdi-font-cache.patch: Bug 717178, cache GDI font faces to reduce usage of GDI resources
+
+win32-gdi-font-cache-no-HFONT.patch: Bug 717178, don't cache GDI font faces when an HFONT belonging to the caller is passed in
+
 ==== pixman patches ====
 
 pixman-android-cpu-detect.patch: Add CPU detection support for Android, where we can't reliably access /proc/self/auxv.
diff --git a/gfx/cairo/cairo/src/cairo-debug.c b/gfx/cairo/cairo/src/cairo-debug.c
index c95675318397..e9e72b6aa93b 100644
--- a/gfx/cairo/cairo/src/cairo-debug.c
+++ b/gfx/cairo/cairo/src/cairo-debug.c
@@ -69,6 +69,10 @@ cairo_debug_reset_static_data (void)
     _cairo_ft_font_reset_static_data ();
 #endif
 
+#if CAIRO_HAS_WIN32_FONT
+    _cairo_win32_font_reset_static_data ();
+#endif
+
     _cairo_intern_string_reset_static_data ();
 
     _cairo_scaled_font_reset_static_data ();
diff --git a/gfx/cairo/cairo/src/cairo-mutex-list-private.h b/gfx/cairo/cairo/src/cairo-mutex-list-private.h
index 5827667f4ad0..7d5ba0299756 100644
--- a/gfx/cairo/cairo/src/cairo-mutex-list-private.h
+++ b/gfx/cairo/cairo/src/cairo-mutex-list-private.h
@@ -51,6 +51,10 @@ CAIRO_MUTEX_DECLARE (_cairo_scaled_font_error_mutex)
 CAIRO_MUTEX_DECLARE (_cairo_ft_unscaled_font_map_mutex)
 #endif
 
+#if CAIRO_HAS_WIN32_FONT
+CAIRO_MUTEX_DECLARE (_cairo_win32_font_face_mutex)
+#endif
+
 #if CAIRO_HAS_XLIB_SURFACE
 CAIRO_MUTEX_DECLARE (_cairo_xlib_display_mutex)
 #endif
diff --git a/gfx/cairo/cairo/src/cairo-win32-font.c b/gfx/cairo/cairo/src/cairo-win32-font.c
index 6ba20d53d0cf..59ab816f82ac 100644
--- a/gfx/cairo/cairo/src/cairo-win32-font.c
+++ b/gfx/cairo/cairo/src/cairo-win32-font.c
@@ -47,6 +47,8 @@
 #include "cairo-win32-private.h"
 #include "cairo-error-private.h"
 
+#include <wchar.h>
+
 #ifndef SPI_GETFONTSMOOTHINGTYPE
 #define SPI_GETFONTSMOOTHINGTYPE 0x200a
 #endif
@@ -1892,9 +1894,7 @@ struct _cairo_win32_font_face {
 /* implement the platform-specific interface */
 
 static void
-_cairo_win32_font_face_destroy (void *abstract_face)
-{
-}
+_cairo_win32_font_face_destroy (void *abstract_face);
 
 static cairo_bool_t
 _is_scale (const cairo_matrix_t *matrix, double scale)
@@ -1937,6 +1937,125 @@ const cairo_font_face_backend_t _cairo_win32_font_face_backend = {
     _cairo_win32_font_face_scaled_font_create
 };
 
+/* We maintain a hash table from LOGFONT,HFONT => #cairo_font_face_t.
+ * The primary purpose of this mapping is to provide unique
+ * #cairo_font_face_t values so that our cache and mapping from
+ * #cairo_font_face_t => #cairo_scaled_font_t works. Once the
+ * corresponding #cairo_font_face_t objects fall out of downstream
+ * caches, we don't need them in this hash table anymore.
+ *
+ * Modifications to this hash table are protected by
+ * _cairo_win32_font_face_mutex.
+ *
+ * Only #cairo_font_face_t values with null 'hfont' (no
+ * HFONT preallocated by caller) are stored in this table. We rely
+ * on callers to manage the lifetime of the HFONT, and they can't
+ * do that if we share #cairo_font_face_t values with other callers.
+ */
+
+static cairo_hash_table_t *cairo_win32_font_face_hash_table = NULL;
+
+static int
+_cairo_win32_font_face_keys_equal (const void *key_a,
+				   const void *key_b);
+
+static void
+_cairo_win32_font_face_hash_table_destroy (void)
+{
+    cairo_hash_table_t *hash_table;
+
+    /* We manually acquire the lock rather than calling
+     * _cairo_win32_font_face_hash_table_lock simply to avoid creating
+     * the table only to destroy it again. */
+    CAIRO_MUTEX_LOCK (_cairo_win32_font_face_mutex);
+    hash_table = cairo_win32_font_face_hash_table;
+    cairo_win32_font_face_hash_table = NULL;
+    CAIRO_MUTEX_UNLOCK (_cairo_win32_font_face_mutex);
+
+    if (hash_table != NULL)
+	_cairo_hash_table_destroy (hash_table);
+}
+
+static cairo_hash_table_t *
+_cairo_win32_font_face_hash_table_lock (void)
+{
+    CAIRO_MUTEX_LOCK (_cairo_win32_font_face_mutex);
+
+    if (unlikely (cairo_win32_font_face_hash_table == NULL))
+    {
+	cairo_win32_font_face_hash_table =
+	_cairo_hash_table_create (_cairo_win32_font_face_keys_equal);
+
+	if (unlikely (cairo_win32_font_face_hash_table == NULL)) {
+	    CAIRO_MUTEX_UNLOCK (_cairo_win32_font_face_mutex);
+	    _cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
+	    return NULL;
+	}
+    }
+
+    return cairo_win32_font_face_hash_table;
+}
+
+static void
+_cairo_win32_font_face_hash_table_unlock (void)
+{
+    CAIRO_MUTEX_UNLOCK (_cairo_win32_font_face_mutex);
+}
+
+static void
+_cairo_win32_font_face_init_key (cairo_win32_font_face_t *key,
+				 LOGFONTW                *logfont,
+				 HFONT                    font)
+{
+    unsigned long hash = _CAIRO_HASH_INIT_VALUE;
+
+    key->logfont = *logfont;
+    key->hfont = font;
+
+    hash = _cairo_hash_bytes (0, logfont->lfFaceName, 2*wcslen(logfont->lfFaceName));
+    hash = _cairo_hash_bytes (hash, &logfont->lfWeight, sizeof(logfont->lfWeight));
+    hash = _cairo_hash_bytes (hash, &logfont->lfItalic, sizeof(logfont->lfItalic));
+
+    key->base.hash_entry.hash = hash;
+}
+
+static int
+_cairo_win32_font_face_keys_equal (const void *key_a,
+				   const void *key_b)
+{
+    const cairo_win32_font_face_t *face_a = key_a;
+    const cairo_win32_font_face_t *face_b = key_b;
+
+    if (face_a->logfont.lfWeight         == face_b->logfont.lfWeight &&
+	face_a->logfont.lfItalic         == face_b->logfont.lfItalic &&
+	face_a->logfont.lfUnderline      == face_b->logfont.lfUnderline &&
+	face_a->logfont.lfStrikeOut      == face_b->logfont.lfStrikeOut &&
+	face_a->logfont.lfCharSet        == face_b->logfont.lfCharSet &&
+	face_a->logfont.lfOutPrecision   == face_b->logfont.lfOutPrecision &&
+	face_a->logfont.lfClipPrecision  == face_b->logfont.lfClipPrecision &&
+	face_a->logfont.lfPitchAndFamily == face_b->logfont.lfPitchAndFamily &&
+	(wcscmp (face_a->logfont.lfFaceName, face_b->logfont.lfFaceName) == 0))
+	return TRUE;
+    else
+	return FALSE;
+}
+
+static void
+_cairo_win32_font_face_destroy (void *abstract_face)
+{
+    cairo_hash_table_t *hash_table;
+    cairo_win32_font_face_t *font_face = abstract_face;
+
+    if (!font_face->hfont) {
+        hash_table = _cairo_win32_font_face_hash_table_lock ();
+        if (unlikely (hash_table == NULL)) {
+            return;
+        }
+        _cairo_hash_table_remove (hash_table, &font_face->base.hash_entry);
+        _cairo_win32_font_face_hash_table_unlock ();
+    }
+}
+
 /**
  * cairo_win32_font_face_create_for_logfontw_hfont:
  * @logfont: A #LOGFONTW structure specifying the font to use.
@@ -1959,20 +2078,59 @@ const cairo_font_face_backend_t _cairo_win32_font_face_backend = {
 cairo_font_face_t *
 cairo_win32_font_face_create_for_logfontw_hfont (LOGFONTW *logfont, HFONT font)
 {
-    cairo_win32_font_face_t *font_face;
+    cairo_win32_font_face_t *font_face, key;
+    cairo_hash_table_t *hash_table;
+    cairo_status_t status;
 
+    if (!font) {
+        hash_table = _cairo_win32_font_face_hash_table_lock ();
+        if (unlikely (hash_table == NULL)) {
+            _cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
+	    return (cairo_font_face_t *)&_cairo_font_face_nil;
+        }
+
+        _cairo_win32_font_face_init_key (&key, logfont, font);
+
+        /* Return existing unscaled font if it exists in the hash table. */
+        font_face = _cairo_hash_table_lookup (hash_table,
+                                              &key.base.hash_entry);
+        if (font_face != NULL) {
+	    cairo_font_face_reference (&font_face->base);
+	    goto DONE;
+        }
+    }
+
+    /* Otherwise create it and insert into hash table. */
     font_face = malloc (sizeof (cairo_win32_font_face_t));
     if (!font_face) {
         _cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
-        return (cairo_font_face_t *)&_cairo_font_face_nil;
+	goto FAIL;
     }
 
-    font_face->logfont = *logfont;
-    font_face->hfont = font;
-
+    _cairo_win32_font_face_init_key (font_face, logfont, font);
     _cairo_font_face_init (&font_face->base, &_cairo_win32_font_face_backend);
+    assert (font_face->base.hash_entry.hash == key.base.hash_entry.hash);
+
+    if (!font) {
+        status = _cairo_hash_table_insert (hash_table,
+                                           &font_face->base.hash_entry);
+        if (unlikely (status))
+	    goto FAIL;
+    }
+
+DONE:
+    if (!font) {
+        _cairo_win32_font_face_hash_table_unlock ();
+    }
 
     return &font_face->base;
+
+FAIL:
+    if (!font) {
+        _cairo_win32_font_face_hash_table_unlock ();
+    }
+
+    return (cairo_font_face_t *)&_cairo_font_face_nil;
 }
 
 /**
@@ -2181,3 +2339,9 @@ cairo_win32_scaled_font_get_device_to_logical (cairo_scaled_font_t *scaled_font,
     }
     *device_to_logical = win_font->device_to_logical;
 }
+
+void
+_cairo_win32_font_reset_static_data (void)
+{
+    _cairo_win32_font_face_hash_table_destroy ();
+}
diff --git a/gfx/cairo/cairo/src/cairoint.h b/gfx/cairo/cairo/src/cairoint.h
index 45567d3dd0b8..aeccd70d6fcd 100644
--- a/gfx/cairo/cairo/src/cairoint.h
+++ b/gfx/cairo/cairo/src/cairoint.h
@@ -408,6 +408,9 @@ _cairo_toy_font_face_reset_static_data (void);
 cairo_private void
 _cairo_ft_font_reset_static_data (void);
 
+cairo_private void
+_cairo_win32_font_reset_static_data (void);
+
 /* the font backend interface */
 
 struct _cairo_unscaled_font_backend {
diff --git a/gfx/cairo/win32-gdi-font-cache-no-HFONT.patch b/gfx/cairo/win32-gdi-font-cache-no-HFONT.patch
new file mode 100644
index 000000000000..fe93095aedec
--- /dev/null
+++ b/gfx/cairo/win32-gdi-font-cache-no-HFONT.patch
@@ -0,0 +1,145 @@
+# HG changeset patch
+# User Robert O'Callahan <robert@ocallahan.org>
+# Date 1357107533 -46800
+# Node ID ed54dfdd2facb11a4d4158138b460a31de45e9f7
+# Parent ab6457cc16ec14ea07386dcfc57cad6b8a9ac55d
+Bug 717178. Part 3 alternative: don't put Win32 cairo_font_face_ts into the font-face cache if they were created with an explicit HFONT. r=jrmuizel
+
+diff --git a/gfx/cairo/cairo/src/cairo-win32-font.c b/gfx/cairo/cairo/src/cairo-win32-font.c
+--- a/gfx/cairo/cairo/src/cairo-win32-font.c
++++ b/gfx/cairo/cairo/src/cairo-win32-font.c
+@@ -1941,16 +1942,21 @@ const cairo_font_face_backend_t _cairo_w
+  * The primary purpose of this mapping is to provide unique
+  * #cairo_font_face_t values so that our cache and mapping from
+  * #cairo_font_face_t => #cairo_scaled_font_t works. Once the
+  * corresponding #cairo_font_face_t objects fall out of downstream
+  * caches, we don't need them in this hash table anymore.
+  *
+  * Modifications to this hash table are protected by
+  * _cairo_win32_font_face_mutex.
++ *
++ * Only #cairo_font_face_t values with null 'hfont' (no
++ * HFONT preallocated by caller) are stored in this table. We rely
++ * on callers to manage the lifetime of the HFONT, and they can't
++ * do that if we share #cairo_font_face_t values with other callers.
+  */
+ 
+ static cairo_hash_table_t *cairo_win32_font_face_hash_table = NULL;
+ 
+ static int
+ _cairo_win32_font_face_keys_equal (const void *key_a,
+ 				   const void *key_b);
+ 
+@@ -2036,22 +2042,24 @@ static int
+ }
+ 
+ static void
+ _cairo_win32_font_face_destroy (void *abstract_face)
+ {
+     cairo_hash_table_t *hash_table;
+     cairo_win32_font_face_t *font_face = abstract_face;
+ 
+-    hash_table = _cairo_win32_font_face_hash_table_lock ();
+-    if (unlikely (hash_table == NULL)) {
+-        return;
++    if (!font_face->hfont) {
++        hash_table = _cairo_win32_font_face_hash_table_lock ();
++        if (unlikely (hash_table == NULL)) {
++            return;
++        }
++        _cairo_hash_table_remove (hash_table, &font_face->base.hash_entry);
++        _cairo_win32_font_face_hash_table_unlock ();
+     }
+-    _cairo_hash_table_remove (hash_table, &font_face->base.hash_entry);
+-    _cairo_win32_font_face_hash_table_unlock ();
+ }
+ 
+ /**
+  * cairo_win32_font_face_create_for_logfontw_hfont:
+  * @logfont: A #LOGFONTW structure specifying the font to use.
+  *   If @font is %NULL then the lfHeight, lfWidth, lfOrientation and lfEscapement
+  *   fields of this structure are ignored. Otherwise lfWidth, lfOrientation and
+  *   lfEscapement must be zero.
+@@ -2070,55 +2078,63 @@ static void
+  **/
+ cairo_font_face_t *
+ cairo_win32_font_face_create_for_logfontw_hfont (LOGFONTW *logfont, HFONT font)
+ {
+     cairo_win32_font_face_t *font_face, key;
+     cairo_hash_table_t *hash_table;
+     cairo_status_t status;
+ 
+-    hash_table = _cairo_win32_font_face_hash_table_lock ();
+-    if (unlikely (hash_table == NULL)) {
+-        _cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
+-	return (cairo_font_face_t *)&_cairo_font_face_nil;
+-    }
++    if (!font) {
++        hash_table = _cairo_win32_font_face_hash_table_lock ();
++        if (unlikely (hash_table == NULL)) {
++            _cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
++	    return (cairo_font_face_t *)&_cairo_font_face_nil;
++        }
+ 
+-    _cairo_win32_font_face_init_key (&key, logfont, font);
++        _cairo_win32_font_face_init_key (&key, logfont, font);
+ 
+-    /* Return existing unscaled font if it exists in the hash table. */
+-    font_face = _cairo_hash_table_lookup (hash_table,
+-					 &key.base.hash_entry);
+-    if (font_face != NULL) {
+-	cairo_font_face_reference (&font_face->base);
+-	goto DONE;
++        /* Return existing unscaled font if it exists in the hash table. */
++        font_face = _cairo_hash_table_lookup (hash_table,
++                                              &key.base.hash_entry);
++        if (font_face != NULL) {
++	    cairo_font_face_reference (&font_face->base);
++	    goto DONE;
++        }
+     }
+ 
+     /* Otherwise create it and insert into hash table. */
+     font_face = malloc (sizeof (cairo_win32_font_face_t));
+     if (!font_face) {
+         _cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
+ 	goto FAIL;
+     }
+ 
+     _cairo_win32_font_face_init_key (font_face, logfont, font);
+     _cairo_font_face_init (&font_face->base, &_cairo_win32_font_face_backend);
++    assert (font_face->base.hash_entry.hash == key.base.hash_entry.hash);
+ 
+-    assert (font_face->base.hash_entry.hash == key.base.hash_entry.hash);
+-    status = _cairo_hash_table_insert (hash_table,
+-				       &font_face->base.hash_entry);
+-    if (unlikely (status))
+-	goto FAIL;
++    if (!font) {
++        status = _cairo_hash_table_insert (hash_table,
++                                           &font_face->base.hash_entry);
++        if (unlikely (status))
++	    goto FAIL;
++    }
+ 
+ DONE:
+-    _cairo_win32_font_face_hash_table_unlock ();
++    if (!font) {
++        _cairo_win32_font_face_hash_table_unlock ();
++    }
+ 
+     return &font_face->base;
+ 
+ FAIL:
+-    _cairo_win32_font_face_hash_table_unlock ();
++    if (!font) {
++        _cairo_win32_font_face_hash_table_unlock ();
++    }
+ 
+     return (cairo_font_face_t *)&_cairo_font_face_nil;
+ }
+ 
+ /**
+  * cairo_win32_font_face_create_for_logfontw:
+  * @logfont: A #LOGFONTW structure specifying the font to use.
+  *   The lfHeight, lfWidth, lfOrientation and lfEscapement
diff --git a/gfx/cairo/win32-gdi-font-cache.patch b/gfx/cairo/win32-gdi-font-cache.patch
new file mode 100644
index 000000000000..e082a2e4dcae
--- /dev/null
+++ b/gfx/cairo/win32-gdi-font-cache.patch
@@ -0,0 +1,375 @@
+# HG changeset patch
+# User Andrea Canciani <ranma42@gmail.com>, Adrian Johnson <ajohnson@redneon.com>
+# Date 1354838294 -46800
+# Node ID 390df735b9d5c5ba07a4d3fe9ca2ebc9e7626a78
+# Parent e30a5b6a5a003b85fc1ca8b76719a56ef59d976e
+Bug 717178. Part 2: Import changesets eb29a25d, 6e3e3291 and 101fab7c from upstream.
+======
+
+From 101fab7cd8a90f7cf3d8113c792b3f8c2a9afb7d Mon Sep 17 00:00:00 2001
+From: Andrea Canciani <ranma42@gmail.com>
+Date: Wed, 15 Jun 2011 09:37:36 +0000
+Subject: win32-font: Improve static data reset function
+
+The hashtable is guaranteed to only contain font faces which are
+currently referenced, hence there is no need to remove any font face
+when it is reset (just like for toy-font).
+
+This makes the function simpler and fixes the assertion
+
+Assertion failed: predicate != NULL, file cairo-hash.c, line 373
+
+hit by multiple tests (the first one being "clear").
+
+See https://bugs.freedesktop.org/show_bug.cgi?id=38049
+
+======
+
+From eb29a25dd6dddc511388bf883c9b95843ecdb823 Mon Sep 17 00:00:00 2001
+From: Adrian Johnson <ajohnson@redneon.com>
+Date: Tue, 16 Nov 2010 13:18:39 +0000
+Subject: win32: Use a font_face hash table to provide unique font faces
+
+Similar to the freetype and toy font backends, use a hash table
+to map logfont,hfont to font faces.
+
+This fixes the multiple embedding of the same font in PDF.
+
+https://bugs.freedesktop.org/show_bug.cgi?id=24849
+
+======
+
+From 6e3e329170ab4b96bc0d587c8071e869e228e758 Mon Sep 17 00:00:00 2001
+From: Adrian Johnson <ajohnson@redneon.com>
+Date: Thu, 18 Nov 2010 12:37:45 +0000
+Subject: win32: fix font_face hashing
+
+some bugs were discovered while testing with firefox
+
+======
+
+diff --git a/gfx/cairo/cairo/src/cairo-debug.c b/gfx/cairo/cairo/src/cairo-debug.c
+--- a/gfx/cairo/cairo/src/cairo-debug.c
++++ b/gfx/cairo/cairo/src/cairo-debug.c
+@@ -64,16 +64,20 @@ cairo_debug_reset_static_data (void)
+     _cairo_scaled_font_map_destroy ();
+ 
+     _cairo_toy_font_face_reset_static_data ();
+ 
+ #if CAIRO_HAS_FT_FONT
+     _cairo_ft_font_reset_static_data ();
+ #endif
+ 
++#if CAIRO_HAS_WIN32_FONT
++    _cairo_win32_font_reset_static_data ();
++#endif
++
+     _cairo_intern_string_reset_static_data ();
+ 
+     _cairo_scaled_font_reset_static_data ();
+ 
+     _cairo_pattern_reset_static_data ();
+ 
+     _cairo_clip_reset_static_data ();
+ 
+diff --git a/gfx/cairo/cairo/src/cairo-mutex-list-private.h b/gfx/cairo/cairo/src/cairo-mutex-list-private.h
+--- a/gfx/cairo/cairo/src/cairo-mutex-list-private.h
++++ b/gfx/cairo/cairo/src/cairo-mutex-list-private.h
+@@ -46,16 +46,20 @@ CAIRO_MUTEX_DECLARE (_cairo_intern_strin
+ CAIRO_MUTEX_DECLARE (_cairo_scaled_font_map_mutex)
+ CAIRO_MUTEX_DECLARE (_cairo_scaled_glyph_page_cache_mutex)
+ CAIRO_MUTEX_DECLARE (_cairo_scaled_font_error_mutex)
+ 
+ #if CAIRO_HAS_FT_FONT
+ CAIRO_MUTEX_DECLARE (_cairo_ft_unscaled_font_map_mutex)
+ #endif
+ 
++#if CAIRO_HAS_WIN32_FONT
++CAIRO_MUTEX_DECLARE (_cairo_win32_font_face_mutex)
++#endif
++
+ #if CAIRO_HAS_XLIB_SURFACE
+ CAIRO_MUTEX_DECLARE (_cairo_xlib_display_mutex)
+ #endif
+ 
+ #if CAIRO_HAS_XCB_SURFACE
+ CAIRO_MUTEX_DECLARE (_cairo_xcb_connections_mutex)
+ #endif
+ 
+diff --git a/gfx/cairo/cairo/src/cairo-win32-font.c b/gfx/cairo/cairo/src/cairo-win32-font.c
+--- a/gfx/cairo/cairo/src/cairo-win32-font.c
++++ b/gfx/cairo/cairo/src/cairo-win32-font.c
+@@ -42,16 +42,18 @@
+ # define _WIN32_WINNT 0x0500
+ #endif
+ 
+ #include "cairoint.h"
+ 
+ #include "cairo-win32-private.h"
+ #include "cairo-error-private.h"
+ 
++#include <wchar.h>
++
+ #ifndef SPI_GETFONTSMOOTHINGTYPE
+ #define SPI_GETFONTSMOOTHINGTYPE 0x200a
+ #endif
+ #ifndef FE_FONTSMOOTHINGCLEARTYPE
+ #define FE_FONTSMOOTHINGCLEARTYPE 2
+ #endif
+ #ifndef CLEARTYPE_QUALITY
+ #define CLEARTYPE_QUALITY 5
+@@ -1887,19 +1889,17 @@ struct _cairo_win32_font_face {
+     cairo_font_face_t base;
+     LOGFONTW logfont;
+     HFONT hfont;
+ };
+ 
+ /* implement the platform-specific interface */
+ 
+ static void
+-_cairo_win32_font_face_destroy (void *abstract_face)
+-{
+-}
++_cairo_win32_font_face_destroy (void *abstract_face);
+ 
+ static cairo_bool_t
+ _is_scale (const cairo_matrix_t *matrix, double scale)
+ {
+     return matrix->xx == scale && matrix->yy == scale &&
+            matrix->xy == 0. && matrix->yx == 0. &&
+            matrix->x0 == 0. && matrix->y0 == 0.;
+ }
+@@ -1932,16 +1932,128 @@ static cairo_status_t
+ 
+ const cairo_font_face_backend_t _cairo_win32_font_face_backend = {
+     CAIRO_FONT_TYPE_WIN32,
+     _cairo_win32_font_face_create_for_toy,
+     _cairo_win32_font_face_destroy,
+     _cairo_win32_font_face_scaled_font_create
+ };
+ 
++/* We maintain a hash table from LOGFONT,HFONT => #cairo_font_face_t.
++ * The primary purpose of this mapping is to provide unique
++ * #cairo_font_face_t values so that our cache and mapping from
++ * #cairo_font_face_t => #cairo_scaled_font_t works. Once the
++ * corresponding #cairo_font_face_t objects fall out of downstream
++ * caches, we don't need them in this hash table anymore.
++ *
++ * Modifications to this hash table are protected by
++ * _cairo_win32_font_face_mutex.
++ */
++
++static cairo_hash_table_t *cairo_win32_font_face_hash_table = NULL;
++
++static int
++_cairo_win32_font_face_keys_equal (const void *key_a,
++				   const void *key_b);
++
++static void
++_cairo_win32_font_face_hash_table_destroy (void)
++{
++    cairo_hash_table_t *hash_table;
++
++    /* We manually acquire the lock rather than calling
++     * _cairo_win32_font_face_hash_table_lock simply to avoid creating
++     * the table only to destroy it again. */
++    CAIRO_MUTEX_LOCK (_cairo_win32_font_face_mutex);
++    hash_table = cairo_win32_font_face_hash_table;
++    cairo_win32_font_face_hash_table = NULL;
++    CAIRO_MUTEX_UNLOCK (_cairo_win32_font_face_mutex);
++
++    if (hash_table != NULL)
++	_cairo_hash_table_destroy (hash_table);
++}
++
++static cairo_hash_table_t *
++_cairo_win32_font_face_hash_table_lock (void)
++{
++    CAIRO_MUTEX_LOCK (_cairo_win32_font_face_mutex);
++
++    if (unlikely (cairo_win32_font_face_hash_table == NULL))
++    {
++	cairo_win32_font_face_hash_table =
++	_cairo_hash_table_create (_cairo_win32_font_face_keys_equal);
++
++	if (unlikely (cairo_win32_font_face_hash_table == NULL)) {
++	    CAIRO_MUTEX_UNLOCK (_cairo_win32_font_face_mutex);
++	    _cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
++	    return NULL;
++	}
++    }
++
++    return cairo_win32_font_face_hash_table;
++}
++
++static void
++_cairo_win32_font_face_hash_table_unlock (void)
++{
++    CAIRO_MUTEX_UNLOCK (_cairo_win32_font_face_mutex);
++}
++
++static void
++_cairo_win32_font_face_init_key (cairo_win32_font_face_t *key,
++				 LOGFONTW                *logfont,
++				 HFONT                    font)
++{
++    unsigned long hash = _CAIRO_HASH_INIT_VALUE;
++
++    key->logfont = *logfont;
++    key->hfont = font;
++
++    hash = _cairo_hash_bytes (0, logfont->lfFaceName, 2*wcslen(logfont->lfFaceName));
++    hash = _cairo_hash_bytes (hash, &logfont->lfWeight, sizeof(logfont->lfWeight));
++    hash = _cairo_hash_bytes (hash, &logfont->lfItalic, sizeof(logfont->lfItalic));
++
++    key->base.hash_entry.hash = hash;
++}
++
++static int
++_cairo_win32_font_face_keys_equal (const void *key_a,
++				   const void *key_b)
++{
++    const cairo_win32_font_face_t *face_a = key_a;
++    const cairo_win32_font_face_t *face_b = key_b;
++
++    if (face_a->logfont.lfWeight         == face_b->logfont.lfWeight &&
++	face_a->logfont.lfItalic         == face_b->logfont.lfItalic &&
++	face_a->logfont.lfUnderline      == face_b->logfont.lfUnderline &&
++	face_a->logfont.lfStrikeOut      == face_b->logfont.lfStrikeOut &&
++	face_a->logfont.lfCharSet        == face_b->logfont.lfCharSet &&
++	face_a->logfont.lfOutPrecision   == face_b->logfont.lfOutPrecision &&
++	face_a->logfont.lfClipPrecision  == face_b->logfont.lfClipPrecision &&
++	face_a->logfont.lfPitchAndFamily == face_b->logfont.lfPitchAndFamily &&
++	(wcscmp (face_a->logfont.lfFaceName, face_b->logfont.lfFaceName) == 0))
++	return TRUE;
++    else
++	return FALSE;
++}
++
++static void
++_cairo_win32_font_face_destroy (void *abstract_face)
++{
++    cairo_hash_table_t *hash_table;
++    cairo_win32_font_face_t *font_face = abstract_face;
++
++    hash_table = _cairo_win32_font_face_hash_table_lock ();
++    if (unlikely (hash_table == NULL)) {
++        return;
++    }
++    _cairo_hash_table_remove (hash_table, &font_face->base.hash_entry);
++    _cairo_win32_font_face_hash_table_unlock ();
++}
++
+ /**
+  * cairo_win32_font_face_create_for_logfontw_hfont:
+  * @logfont: A #LOGFONTW structure specifying the font to use.
+  *   If @font is %NULL then the lfHeight, lfWidth, lfOrientation and lfEscapement
+  *   fields of this structure are ignored. Otherwise lfWidth, lfOrientation and
+  *   lfEscapement must be zero.
+  * @font: An #HFONT that can be used when the font matrix is a scale by
+  *   -lfHeight and the CTM is identity.
+@@ -1954,30 +2066,61 @@ const cairo_font_face_backend_t _cairo_w
+  * and can be used with functions such as cairo_win32_scaled_font_select_font().
+  *
+  * Return value: a newly created #cairo_font_face_t. Free with
+  *  cairo_font_face_destroy() when you are done using it.
+  **/
+ cairo_font_face_t *
+ cairo_win32_font_face_create_for_logfontw_hfont (LOGFONTW *logfont, HFONT font)
+ {
+-    cairo_win32_font_face_t *font_face;
++    cairo_win32_font_face_t *font_face, key;
++    cairo_hash_table_t *hash_table;
++    cairo_status_t status;
+ 
++    hash_table = _cairo_win32_font_face_hash_table_lock ();
++    if (unlikely (hash_table == NULL)) {
++        _cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
++	return (cairo_font_face_t *)&_cairo_font_face_nil;
++    }
++
++    _cairo_win32_font_face_init_key (&key, logfont, font);
++
++    /* Return existing unscaled font if it exists in the hash table. */
++    font_face = _cairo_hash_table_lookup (hash_table,
++					 &key.base.hash_entry);
++    if (font_face != NULL) {
++	cairo_font_face_reference (&font_face->base);
++	goto DONE;
++    }
++
++    /* Otherwise create it and insert into hash table. */
+     font_face = malloc (sizeof (cairo_win32_font_face_t));
+     if (!font_face) {
+         _cairo_error_throw (CAIRO_STATUS_NO_MEMORY);
+-        return (cairo_font_face_t *)&_cairo_font_face_nil;
++	goto FAIL;
+     }
+ 
+-    font_face->logfont = *logfont;
+-    font_face->hfont = font;
+-
++    _cairo_win32_font_face_init_key (font_face, logfont, font);
+     _cairo_font_face_init (&font_face->base, &_cairo_win32_font_face_backend);
+ 
++    assert (font_face->base.hash_entry.hash == key.base.hash_entry.hash);
++    status = _cairo_hash_table_insert (hash_table,
++				       &font_face->base.hash_entry);
++    if (unlikely (status))
++	goto FAIL;
++
++DONE:
++    _cairo_win32_font_face_hash_table_unlock ();
++
+     return &font_face->base;
++
++FAIL:
++    _cairo_win32_font_face_hash_table_unlock ();
++
++    return (cairo_font_face_t *)&_cairo_font_face_nil;
+ }
+ 
+ /**
+  * cairo_win32_font_face_create_for_logfontw:
+  * @logfont: A #LOGFONTW structure specifying the font to use.
+  *   The lfHeight, lfWidth, lfOrientation and lfEscapement
+  *   fields of this structure are ignored.
+  *
+@@ -2176,8 +2319,14 @@ cairo_win32_scaled_font_get_device_to_lo
+     cairo_win32_scaled_font_t *win_font = (cairo_win32_scaled_font_t *)scaled_font;
+     if (! _cairo_scaled_font_is_win32 (scaled_font)) {
+ 	_cairo_error_throw (CAIRO_STATUS_FONT_TYPE_MISMATCH);
+ 	cairo_matrix_init_identity (device_to_logical);
+ 	return;
+     }
+     *device_to_logical = win_font->device_to_logical;
+ }
++
++void
++_cairo_win32_font_reset_static_data (void)
++{
++    _cairo_win32_font_face_hash_table_destroy ();
++}
+diff --git a/gfx/cairo/cairo/src/cairoint.h b/gfx/cairo/cairo/src/cairoint.h
+--- a/gfx/cairo/cairo/src/cairoint.h
++++ b/gfx/cairo/cairo/src/cairoint.h
+@@ -403,16 +403,19 @@ cairo_private void
+ _cairo_reset_static_data (void);
+ 
+ cairo_private void
+ _cairo_toy_font_face_reset_static_data (void);
+ 
+ cairo_private void
+ _cairo_ft_font_reset_static_data (void);
+ 
++cairo_private void
++_cairo_win32_font_reset_static_data (void);
++
+ /* the font backend interface */
+ 
+ struct _cairo_unscaled_font_backend {
+     void (*destroy)     	    (void		             *unscaled_font);
+ };
+ 
+ /* #cairo_toy_font_face_t - simple family/slant/weight font faces used for
+  * the built-in font API
diff --git a/gfx/harfbuzz/src/Makefile.am b/gfx/harfbuzz/src/Makefile.am
index bb7601e1ecde..558ce08ead9c 100644
--- a/gfx/harfbuzz/src/Makefile.am
+++ b/gfx/harfbuzz/src/Makefile.am
@@ -195,9 +195,13 @@ export_symbols = -export-symbols harfbuzz.def
 harfbuzz_def_dependency = harfbuzz.def
 libharfbuzz_la_LINK = $(CXXLINK) $(libharfbuzz_la_LDFLAGS)
 else
+if HAVE_ICU
+libharfbuzz_la_LINK = $(CXXLINK) $(libharfbuzz_la_LDFLAGS)
+else
 # Use a C linker, not C++; Don't link to libstdc++
 libharfbuzz_la_LINK = $(LINK) $(libharfbuzz_la_LDFLAGS)
 endif
+endif
 
 libharfbuzz_la_SOURCES = $(HBSOURCES) $(HBHEADERS)
 nodist_libharfbuzz_la_SOURCES = $(nodist_HBSOURCES)
@@ -247,17 +251,25 @@ $(srcdir)/hb-ot-shape-complex-indic-machine.hh: hb-ot-shape-complex-indic-machin
 	$(AM_V_GEN)$(top_srcdir)/missing --run ragel -e -F1 -o "$@.tmp" "$<" && \
 	mv "$@.tmp" "$@" || ( $(RM) "$@.tmp" && false )
 
-noinst_PROGRAMS = main test-would-substitute
+noinst_PROGRAMS = main test test-would-substitute test-size-params
 bin_PROGRAMS =
 
 main_SOURCES = main.cc
 main_CPPFLAGS = $(HBCFLAGS)
 main_LDADD = libharfbuzz.la $(HBLIBS)
 
+test_SOURCES = test.cc
+test_CPPFLAGS = $(HBCFLAGS) $(FREETYPE_CFLAGS)
+test_LDADD = libharfbuzz.la $(HBLIBS) $(FREETYPE_LIBS)
+
 test_would_substitute_SOURCES = test-would-substitute.cc
 test_would_substitute_CPPFLAGS = $(HBCFLAGS) $(FREETYPE_CFLAGS)
 test_would_substitute_LDADD = libharfbuzz.la $(HBLIBS) $(FREETYPE_LIBS)
 
+test_size_params_SOURCES = test-size-params.cc
+test_size_params_CPPFLAGS = $(HBCFLAGS)
+test_size_params_LDADD = libharfbuzz.la $(HBLIBS)
+
 dist_check_SCRIPTS = \
 	check-c-linkage-decls.sh \
 	check-header-guards.sh \
diff --git a/gfx/harfbuzz/src/check-exported-symbols.sh b/gfx/harfbuzz/src/check-exported-symbols.sh
index a7d6f9b6af93..6f0bf7fd8233 100644
--- a/gfx/harfbuzz/src/check-exported-symbols.sh
+++ b/gfx/harfbuzz/src/check-exported-symbols.sh
@@ -24,7 +24,7 @@ for def in $defs; do
 		echo "Checking that $so has the same symbol list as $def"
 		{
 			echo EXPORTS
-			nm "$so" | grep ' [BCDGINRSTVW] ' | grep -v ' T _fini\>\| T _init\>' | cut -d' ' -f3
+			nm "$so" | grep ' [BCDGINRSTVW] ' | grep -v ' T _fini\>\| T _init\>\| __bss_start\>\| __bss_start__\>\| __bss_end__\>\| _edata\>\| _end\>\| _bss_end__\>\| __end__\>' | cut -d' ' -f3
 			stat=1
 			# cheat: copy the last line from the def file!
 			tail -n1 "$def"
diff --git a/gfx/harfbuzz/src/check-internal-symbols.sh b/gfx/harfbuzz/src/check-internal-symbols.sh
index f48d1448e4b6..a8fdc537dd75 100755
--- a/gfx/harfbuzz/src/check-internal-symbols.sh
+++ b/gfx/harfbuzz/src/check-internal-symbols.sh
@@ -19,7 +19,7 @@ for suffix in .so; do
 	so=`echo .libs/libharfbuzz$suffix`
 	if test -f "$so"; then
 		echo "Checking that we are not exposing internal symbols"
-		if nm "$so" | grep ' [BCDGINRSTVW] ' | grep -v ' T _fini\>\| T _init\>\| T hb_'; then
+		if nm "$so" | grep ' [BCDGINRSTVW] ' | grep -v ' T _fini\>\| T _init\>\| T hb_\| __bss_start\>\| __bss_start__\>\| __bss_end__\>\| _edata\>\| _end\>\| _bss_end__\>\| __end__\>'; then
 			echo "Ouch, internal symbols exposed"
 			stat=1
 		fi
diff --git a/gfx/harfbuzz/src/hb-atomic-private.hh b/gfx/harfbuzz/src/hb-atomic-private.hh
index 5861a7124b3d..67579cdd4429 100644
--- a/gfx/harfbuzz/src/hb-atomic-private.hh
+++ b/gfx/harfbuzz/src/hb-atomic-private.hh
@@ -59,7 +59,7 @@ static inline void HBMemoryBarrier (void) {
 }
 #endif
 
-typedef long hb_atomic_int_t;
+typedef LONG hb_atomic_int_t;
 #define hb_atomic_int_add(AI, V)	InterlockedExchangeAdd (&(AI), (V))
 
 #define hb_atomic_ptr_get(P)		(HBMemoryBarrier (), (void *) *(P))
@@ -69,12 +69,25 @@ typedef long hb_atomic_int_t;
 #elif !defined(HB_NO_MT) && defined(__APPLE__)
 
 #include <libkern/OSAtomic.h>
+#ifdef __MAC_OS_X_MIN_REQUIRED
+#include <AvailabilityMacros.h>
+#elif defined(__IPHONE_OS_MIN_REQUIRED)
+#include <Availability.h>
+#endif
 
 typedef int32_t hb_atomic_int_t;
 #define hb_atomic_int_add(AI, V)	(OSAtomicAdd32Barrier ((V), &(AI)) - (V))
 
 #define hb_atomic_ptr_get(P)		(OSMemoryBarrier (), (void *) *(P))
+#if (MAC_OS_X_VERSION_MIN_REQUIRED > MAC_OS_X_VERSION_10_4 || __IPHONE_VERSION_MIN_REQUIRED >= 20100)
 #define hb_atomic_ptr_cmpexch(P,O,N)	OSAtomicCompareAndSwapPtrBarrier ((void *) (O), (void *) (N), (void **) (P))
+#else
+#if __ppc64__ || __x86_64__
+#define hb_atomic_ptr_cmpexch(P,O,N)    OSAtomicCompareAndSwap64Barrier ((int64_t) (O), (int64_t) (N), (int64_t*) (P))
+#else
+#define hb_atomic_ptr_cmpexch(P,O,N)    OSAtomicCompareAndSwap32Barrier ((int32_t) (O), (int32_t) (N), (int32_t*) (P))
+#endif
+#endif
 
 
 #elif !defined(HB_NO_MT) && defined(HAVE_INTEL_ATOMIC_PRIMITIVES)
diff --git a/gfx/harfbuzz/src/hb-buffer.cc b/gfx/harfbuzz/src/hb-buffer.cc
index 0f5a97f157b4..4b644e40217d 100644
--- a/gfx/harfbuzz/src/hb-buffer.cc
+++ b/gfx/harfbuzz/src/hb-buffer.cc
@@ -493,8 +493,8 @@ hb_buffer_t::merge_out_clusters (unsigned int start,
 void
 hb_buffer_t::guess_segment_properties (void)
 {
-  if (unlikely (!len)) return;
-  assert (content_type == HB_BUFFER_CONTENT_TYPE_UNICODE);
+  assert (content_type == HB_BUFFER_CONTENT_TYPE_UNICODE ||
+	  (!len && content_type == HB_BUFFER_CONTENT_TYPE_INVALID));
 
   /* If script is set to INVALID, guess from buffer contents */
   if (props.script == HB_SCRIPT_INVALID) {
@@ -1071,8 +1071,8 @@ hb_buffer_normalize_glyphs (hb_buffer_t *buffer)
  */
 
 static const char *serialize_formats[] = {
-  "TEXT",
-  "JSON",
+  "text",
+  "json",
   NULL
 };
 
diff --git a/gfx/harfbuzz/src/hb-common.cc b/gfx/harfbuzz/src/hb-common.cc
index 33a514dbfda8..9422555cfbc6 100644
--- a/gfx/harfbuzz/src/hb-common.cc
+++ b/gfx/harfbuzz/src/hb-common.cc
@@ -363,8 +363,7 @@ bool
 hb_user_data_array_t::set (hb_user_data_key_t *key,
 			   void *              data,
 			   hb_destroy_func_t   destroy,
-			   hb_bool_t           replace,
-			   hb_mutex_t         &lock)
+			   hb_bool_t           replace)
 {
   if (!key)
     return false;
@@ -382,20 +381,13 @@ hb_user_data_array_t::set (hb_user_data_key_t *key,
 }
 
 void *
-hb_user_data_array_t::get (hb_user_data_key_t *key,
-			   hb_mutex_t         &lock)
+hb_user_data_array_t::get (hb_user_data_key_t *key)
 {
   hb_user_data_item_t item = {NULL };
 
   return items.find (key, &item, lock) ? item.data : NULL;
 }
 
-void
-hb_user_data_array_t::finish (hb_mutex_t &lock)
-{
-  items.finish (lock);
-}
-
 
 /* hb_version */
 
diff --git a/gfx/harfbuzz/src/hb-coretext.cc b/gfx/harfbuzz/src/hb-coretext.cc
index 4152a3944c95..8f94795928c3 100644
--- a/gfx/harfbuzz/src/hb-coretext.cc
+++ b/gfx/harfbuzz/src/hb-coretext.cc
@@ -29,10 +29,6 @@
 #define HB_SHAPER coretext
 #include "hb-shaper-impl-private.hh"
 
-#define GlyphID GlyphID_mac
-#include <ApplicationServices/ApplicationServices.h>
-#undef GlyphID
-
 #include "hb-coretext.h"
 
 
@@ -95,6 +91,14 @@ _hb_coretext_shaper_face_data_destroy (hb_coretext_shaper_face_data_t *data)
   free (data);
 }
 
+CGFontRef
+hb_coretext_face_get_cg_font (hb_face_t *face)
+{
+  if (unlikely (!hb_coretext_shaper_face_data_ensure (face))) return NULL;
+  hb_coretext_shaper_face_data_t *face_data = HB_SHAPER_DATA_GET (face);
+  return face_data->cg_font;
+}
+
 
 /*
  * shaper font data
@@ -153,19 +157,19 @@ _hb_coretext_shaper_shape_plan_data_destroy (hb_coretext_shaper_shape_plan_data_
 {
 }
 
+CTFontRef
+hb_coretext_font_get_ct_font (hb_font_t *font)
+{
+  if (unlikely (!hb_coretext_shaper_font_data_ensure (font))) return NULL;
+  hb_coretext_shaper_font_data_t *font_data = HB_SHAPER_DATA_GET (font);
+  return font_data->ct_font;
+}
+
 
 /*
  * shaper
  */
 
-CTFontRef
-hb_coretext_font_get_ct_font (hb_font_t *font)
-{
-  if (unlikely (!hb_coretext_shaper_font_data_ensure (font))) return 0;
-  hb_coretext_shaper_font_data_t *font_data = HB_SHAPER_DATA_GET (font);
-  return font_data->ct_font;
-}
-
 hb_bool_t
 _hb_coretext_shape (hb_shape_plan_t    *shape_plan,
 		    hb_font_t          *font,
@@ -212,26 +216,22 @@ _hb_coretext_shape (hb_shape_plan_t    *shape_plan,
   CFDictionaryRef attrs = CFDictionaryCreate (kCFAllocatorDefault,
                                               (const void**) &kCTFontAttributeName,
                                               (const void**) &font_data->ct_font,
-                                              1, // count of attributes
+                                              1, /* count of attributes */
                                               &kCFTypeDictionaryKeyCallBacks,
                                               &kCFTypeDictionaryValueCallBacks);
 
-  // TODO: support features
+  /* TODO: support features */
 
-  // Now we can create an attributed string
   CFAttributedStringRef attr_string = CFAttributedStringCreate (kCFAllocatorDefault, string_ref, attrs);
   CFRelease (string_ref);
   CFRelease (attrs);
 
-  // Create the CoreText line from our string, then we're done with it
   CTLineRef line = CTLineCreateWithAttributedString (attr_string);
   CFRelease (attr_string);
 
-  // and finally retrieve the glyph data and store into the gfxTextRun
   CFArrayRef glyph_runs = CTLineGetGlyphRuns (line);
   unsigned int num_runs = CFArrayGetCount (glyph_runs);
 
-  // Iterate through the glyph runs.
   bool success = true;
   buffer->len = 0;
 
@@ -246,11 +246,9 @@ _hb_coretext_shape (hb_shape_plan_t    *shape_plan,
 
     buffer->ensure (buffer->len + num_glyphs);
 
-    // retrieve the laid-out glyph data from the CTRun
-
-    // Testing indicates that CTRunGetGlyphsPtr (almost?) always succeeds,
-    // and so copying data to our own buffer with CTRunGetGlyphs will be
-    // extremely rare.
+    /* Testing indicates that CTRunGetGlyphsPtr (almost?) always succeeds,
+     * and so copying data to our own buffer with CTRunGetGlyphs will be
+     * extremely rare. */
 
     unsigned int scratch_size;
     char *scratch = (char *) buffer->get_scratch_buffer (&scratch_size);
@@ -294,7 +292,7 @@ _hb_coretext_shape (hb_shape_plan_t    *shape_plan,
       info->codepoint = glyphs[j];
       info->cluster = string_indices[j];
 
-      // currently, we do all x-positioning by setting the advance, we never use x-offset
+      /* Currently, we do all x-positioning by setting the advance, we never use x-offset. */
       info->mask = advance;
       info->var1.u32 = 0;
       info->var2.u32 = positions[j].y;
@@ -316,12 +314,13 @@ _hb_coretext_shape (hb_shape_plan_t    *shape_plan,
     pos->y_offset = info->var2.u32;
   }
 
-  // Fix up clusters so that we never return out-of-order indices;
-  // if core text has reordered glyphs, we'll merge them to the
-  // beginning of the reordered cluster.
-  // This does *not* mean we'll form the same clusters as Uniscribe
-  // or the native OT backend, only that the cluster indices will be
-  // non-decreasing in the output buffer.
+  /* Fix up clusters so that we never return out-of-order indices;
+   * if core text has reordered glyphs, we'll merge them to the
+   * beginning of the reordered cluster.
+   *
+   * This does *not* mean we'll form the same clusters as Uniscribe
+   * or the native OT backend, only that the cluster indices will be
+   * monotonic in the output buffer. */
   if (HB_DIRECTION_IS_FORWARD (buffer->props.direction)) {
     unsigned int prev_cluster = 0;
     for (unsigned int i = 0; i < count; i++) {
@@ -337,7 +336,6 @@ _hb_coretext_shape (hb_shape_plan_t    *shape_plan,
       prev_cluster = curr_cluster;
     }
   } else {
-    // For RTL runs, we make them non-increasing instead.
     unsigned int prev_cluster = (unsigned int)-1;
     for (unsigned int i = 0; i < count; i++) {
       unsigned int curr_cluster = buffer->info[i].cluster;
diff --git a/gfx/harfbuzz/src/hb-coretext.h b/gfx/harfbuzz/src/hb-coretext.h
index 0b34203d991f..c4954fa1b2ca 100644
--- a/gfx/harfbuzz/src/hb-coretext.h
+++ b/gfx/harfbuzz/src/hb-coretext.h
@@ -34,6 +34,9 @@
 HB_BEGIN_DECLS
 
 
+CGFontRef
+hb_coretext_face_get_cg_font (hb_face_t *face);
+
 CTFontRef
 hb_coretext_font_get_ct_font (hb_font_t *font);
 
diff --git a/gfx/harfbuzz/src/hb-fallback-shape.cc b/gfx/harfbuzz/src/hb-fallback-shape.cc
index 989596ee55b0..bdc8a80c4bd0 100644
--- a/gfx/harfbuzz/src/hb-fallback-shape.cc
+++ b/gfx/harfbuzz/src/hb-fallback-shape.cc
@@ -35,13 +35,13 @@
 struct hb_fallback_shaper_face_data_t {};
 
 hb_fallback_shaper_face_data_t *
-_hb_fallback_shaper_face_data_create (hb_face_t *face)
+_hb_fallback_shaper_face_data_create (hb_face_t *face HB_UNUSED)
 {
   return (hb_fallback_shaper_face_data_t *) HB_SHAPER_DATA_SUCCEEDED;
 }
 
 void
-_hb_fallback_shaper_face_data_destroy (hb_fallback_shaper_face_data_t *data)
+_hb_fallback_shaper_face_data_destroy (hb_fallback_shaper_face_data_t *data HB_UNUSED)
 {
 }
 
@@ -53,13 +53,13 @@ _hb_fallback_shaper_face_data_destroy (hb_fallback_shaper_face_data_t *data)
 struct hb_fallback_shaper_font_data_t {};
 
 hb_fallback_shaper_font_data_t *
-_hb_fallback_shaper_font_data_create (hb_font_t *font)
+_hb_fallback_shaper_font_data_create (hb_font_t *font HB_UNUSED)
 {
   return (hb_fallback_shaper_font_data_t *) HB_SHAPER_DATA_SUCCEEDED;
 }
 
 void
-_hb_fallback_shaper_font_data_destroy (hb_fallback_shaper_font_data_t *data)
+_hb_fallback_shaper_font_data_destroy (hb_fallback_shaper_font_data_t *data HB_UNUSED)
 {
 }
 
@@ -89,7 +89,7 @@ _hb_fallback_shaper_shape_plan_data_destroy (hb_fallback_shaper_shape_plan_data_
  */
 
 hb_bool_t
-_hb_fallback_shape (hb_shape_plan_t    *shape_plan,
+_hb_fallback_shape (hb_shape_plan_t    *shape_plan HB_UNUSED,
 		    hb_font_t          *font,
 		    hb_buffer_t        *buffer,
 		    const hb_feature_t *features HB_UNUSED,
diff --git a/gfx/harfbuzz/src/hb-glib.cc b/gfx/harfbuzz/src/hb-glib.cc
index 046275879890..676e6601628b 100644
--- a/gfx/harfbuzz/src/hb-glib.cc
+++ b/gfx/harfbuzz/src/hb-glib.cc
@@ -334,7 +334,7 @@ hb_glib_unicode_decompose (hb_unicode_funcs_t *ufuncs HB_UNUSED,
 }
 
 static unsigned int
-hb_glib_unicode_decompose_compatibility (hb_unicode_funcs_t *ufuncs,
+hb_glib_unicode_decompose_compatibility (hb_unicode_funcs_t *ufuncs HB_UNUSED,
 					 hb_codepoint_t      u,
 					 hb_codepoint_t     *decomposed,
 					 void               *user_data HB_UNUSED)
diff --git a/gfx/harfbuzz/src/hb-graphite2.cc b/gfx/harfbuzz/src/hb-graphite2.cc
index 6c890d42c638..16ef9a4dabee 100644
--- a/gfx/harfbuzz/src/hb-graphite2.cc
+++ b/gfx/harfbuzz/src/hb-graphite2.cc
@@ -113,7 +113,7 @@ _hb_graphite2_shaper_face_data_create (hb_face_t *face)
     hb_blob_destroy (silf_blob);
 
   data->face = face;
-  data->grface = gr_make_face (data, &hb_graphite2_get_table, gr_face_default);
+  data->grface = gr_make_face (data, &hb_graphite2_get_table, gr_face_preloadAll);
 
   if (unlikely (!data->grface)) {
     free (data);
@@ -141,6 +141,13 @@ _hb_graphite2_shaper_face_data_destroy (hb_graphite2_shaper_face_data_t *data)
   free (data);
 }
 
+gr_face *
+hb_graphite2_face_get_gr_face (hb_face_t *face)
+{
+  if (unlikely (!hb_graphite2_shaper_face_data_ensure (face))) return NULL;
+  return HB_SHAPER_DATA_GET (face)->grface;
+}
+
 
 /*
  * shaper font data
@@ -168,6 +175,13 @@ _hb_graphite2_shaper_font_data_destroy (hb_graphite2_shaper_font_data_t *data)
   gr_font_destroy (data);
 }
 
+gr_font *
+hb_graphite2_font_get_gr_font (hb_font_t *font)
+{
+  if (unlikely (!hb_graphite2_shaper_font_data_ensure (font))) return NULL;
+  return HB_SHAPER_DATA_GET (font);
+}
+
 
 /*
  * shaper shape_plan data
@@ -311,10 +325,18 @@ _hb_graphite2_shape (hb_shape_plan_t    *shape_plan,
   }
   ci++;
 
-  buffer->clear_output ();
+  //buffer->clear_output ();
   for (unsigned int i = 0; i < ci; ++i)
-    buffer->replace_glyphs (clusters[i].num_chars, clusters[i].num_glyphs, gids + clusters[i].base_glyph);
-  buffer->swap_buffers ();
+  {
+    for (unsigned int j = 0; j < clusters[i].num_glyphs; ++j)
+    {
+      hb_glyph_info_t *info = &buffer->info[clusters[i].base_glyph + j];
+      info->codepoint = gids[clusters[i].base_glyph + j];
+      info->cluster = gr_cinfo_base(gr_seg_cinfo(seg, clusters[i].base_char));
+    }
+  }
+  buffer->len = glyph_count;
+  //buffer->swap_buffers ();
 
   if (HB_DIRECTION_IS_BACKWARD(buffer->props.direction))
     curradvx = gr_seg_advance_X(seg);
diff --git a/gfx/harfbuzz/src/hb-graphite2.h b/gfx/harfbuzz/src/hb-graphite2.h
index 81224955465f..bea68f939b43 100644
--- a/gfx/harfbuzz/src/hb-graphite2.h
+++ b/gfx/harfbuzz/src/hb-graphite2.h
@@ -33,7 +33,13 @@ HB_BEGIN_DECLS
 
 #define HB_GRAPHITE2_TAG_SILF HB_TAG('S','i','l','f')
 
-/* TODO add gr_font/face etc getters and other glue API */
+
+gr_face *
+hb_graphite2_face_get_gr_face (hb_face_t *face);
+
+gr_font *
+hb_graphite2_font_get_gr_font (hb_font_t *font);
+
 
 HB_END_DECLS
 
diff --git a/gfx/harfbuzz/src/hb-icu-le.cc b/gfx/harfbuzz/src/hb-icu-le.cc
index d73752d171b9..c05d330b9573 100644
--- a/gfx/harfbuzz/src/hb-icu-le.cc
+++ b/gfx/harfbuzz/src/hb-icu-le.cc
@@ -43,13 +43,13 @@
 struct hb_icu_le_shaper_face_data_t {};
 
 hb_icu_le_shaper_face_data_t *
-_hb_icu_le_shaper_face_data_create (hb_face_t *face)
+_hb_icu_le_shaper_face_data_create (hb_face_t *face HB_UNUSED)
 {
   return (hb_icu_le_shaper_face_data_t *) HB_SHAPER_DATA_SUCCEEDED;
 }
 
 void
-_hb_icu_le_shaper_face_data_destroy (hb_icu_le_shaper_face_data_t *data)
+_hb_icu_le_shaper_face_data_destroy (hb_icu_le_shaper_face_data_t *data HB_UNUSED)
 {
 }
 
@@ -88,7 +88,7 @@ _hb_icu_le_shaper_font_data_destroy (hb_icu_le_shaper_font_data_t *data)
 struct hb_icu_le_shaper_shape_plan_data_t {};
 
 hb_icu_le_shaper_shape_plan_data_t *
-_hb_icu_le_shaper_shape_plan_data_create (hb_shape_plan_t    *shape_plan,
+_hb_icu_le_shaper_shape_plan_data_create (hb_shape_plan_t    *shape_plan HB_UNUSED,
 					  const hb_feature_t *user_features,
 					  unsigned int        num_user_features)
 {
@@ -115,7 +115,7 @@ _hb_icu_le_shape (hb_shape_plan_t    *shape_plan,
   LEFontInstance *font_instance = HB_SHAPER_DATA_GET (font);
   le_int32 script_code = hb_icu_script_from_script (shape_plan->props.script);
   le_int32 language_code = -1 /* TODO */;
-  le_int32 typography_flags = 3; // essential for ligatures and kerning
+  le_int32 typography_flags = 3; /* Needed for ligatures and kerning */
   LEErrorCode status = LE_NO_ERROR;
   le_engine *le = le_create ((const le_font *) font_instance,
 			     script_code,
diff --git a/gfx/harfbuzz/src/hb-object-private.hh b/gfx/harfbuzz/src/hb-object-private.hh
index c48f24231d9c..8a9ae34dbeeb 100644
--- a/gfx/harfbuzz/src/hb-object-private.hh
+++ b/gfx/harfbuzz/src/hb-object-private.hh
@@ -65,7 +65,7 @@ struct hb_reference_count_t
 
 /* user_data */
 
-#define HB_USER_DATA_ARRAY_INIT {HB_LOCKABLE_SET_INIT}
+#define HB_USER_DATA_ARRAY_INIT {HB_MUTEX_INIT, HB_LOCKABLE_SET_INIT}
 struct hb_user_data_array_t
 {
   /* TODO Add tracing. */
@@ -81,20 +81,19 @@ struct hb_user_data_array_t
     void finish (void) { if (destroy) destroy (data); }
   };
 
+  hb_mutex_t lock;
   hb_lockable_set_t<hb_user_data_item_t, hb_mutex_t> items;
 
-  inline void init (void) { items.init (); }
+  inline void init (void) { lock.init (); items.init (); }
 
   HB_INTERNAL bool set (hb_user_data_key_t *key,
 			void *              data,
 			hb_destroy_func_t   destroy,
-			hb_bool_t           replace,
-			hb_mutex_t         &lock);
+			hb_bool_t           replace);
 
-  HB_INTERNAL void *get (hb_user_data_key_t *key,
-			hb_mutex_t          &lock);
+  HB_INTERNAL void *get (hb_user_data_key_t *key);
 
-  HB_INTERNAL void finish (hb_mutex_t &lock);
+  inline void finish (void) { items.finish (lock); lock.finish (); }
 };
 
 
@@ -103,10 +102,9 @@ struct hb_user_data_array_t
 struct hb_object_header_t
 {
   hb_reference_count_t ref_count;
-  hb_mutex_t mutex;
   hb_user_data_array_t user_data;
 
-#define HB_OBJECT_HEADER_STATIC {HB_REFERENCE_COUNT_INVALID, HB_MUTEX_INIT, HB_USER_DATA_ARRAY_INIT}
+#define HB_OBJECT_HEADER_STATIC {HB_REFERENCE_COUNT_INVALID, HB_USER_DATA_ARRAY_INIT}
 
   static inline void *create (unsigned int size) {
     hb_object_header_t *obj = (hb_object_header_t *) calloc (1, size);
@@ -119,7 +117,6 @@ struct hb_object_header_t
 
   inline void init (void) {
     ref_count.init (1);
-    mutex.init ();
     user_data.init ();
   }
 
@@ -140,20 +137,11 @@ struct hb_object_header_t
       return false;
 
     ref_count.finish (); /* Do this before user_data */
-    user_data.finish (mutex);
-    mutex.finish ();
+    user_data.finish ();
 
     return true;
   }
 
-  inline void lock (void) {
-    mutex.lock ();
-  }
-
-  inline void unlock (void) {
-    mutex.unlock ();
-  }
-
   inline bool set_user_data (hb_user_data_key_t *key,
 			     void *              data,
 			     hb_destroy_func_t   destroy_func,
@@ -161,14 +149,14 @@ struct hb_object_header_t
     if (unlikely (!this || this->is_inert ()))
       return false;
 
-    return user_data.set (key, data, destroy_func, replace, mutex);
+    return user_data.set (key, data, destroy_func, replace);
   }
 
   inline void *get_user_data (hb_user_data_key_t *key) {
     if (unlikely (!this || this->is_inert ()))
       return NULL;
 
-    return user_data.get (key, mutex);
+    return user_data.get (key);
   }
 
   inline void trace (const char *function) const {
@@ -219,18 +207,6 @@ static inline bool hb_object_destroy (Type *obj)
   return obj->header.destroy ();
 }
 template <typename Type>
-static inline void hb_object_lock (Type *obj)
-{
-  hb_object_trace (obj, HB_FUNC);
-  return obj->header.lock ();
-}
-template <typename Type>
-static inline void hb_object_unlock (Type *obj)
-{
-  hb_object_trace (obj, HB_FUNC);
-  return obj->header.unlock ();
-}
-template <typename Type>
 static inline bool hb_object_set_user_data (Type               *obj,
 					    hb_user_data_key_t *key,
 					    void *              data,
diff --git a/gfx/harfbuzz/src/hb-old.cc b/gfx/harfbuzz/src/hb-old.cc
index 529bffa0c946..a7ea8ed9bbe8 100644
--- a/gfx/harfbuzz/src/hb-old.cc
+++ b/gfx/harfbuzz/src/hb-old.cc
@@ -100,7 +100,7 @@ hb_old_convertStringToGlyphIndices (HB_Font old_font,
 
     glyphs[i] = u;
   }
-  *numGlyphs = length; // XXX
+  *numGlyphs = length; /* XXX */
 
   return true;
 }
@@ -110,7 +110,7 @@ hb_old_getGlyphAdvances (HB_Font old_font,
 			 const HB_Glyph *glyphs,
 			 hb_uint32 numGlyphs,
 			 HB_Fixed *advances,
-			 int flags /*HB_ShaperFlag*/)
+			 int flags /*HB_ShaperFlag*/ HB_UNUSED)
 {
   hb_font_t *font = (hb_font_t *) old_font->userData;
 
@@ -123,7 +123,7 @@ hb_old_canRender (HB_Font old_font,
 		  const HB_UChar16 *string,
 		  hb_uint32 length)
 {
-  return true; // TODO
+  return true; /* TODO */
 }
 
 static HB_Error
@@ -135,7 +135,7 @@ hb_old_getPointInOutline (HB_Font old_font,
 			  HB_Fixed *ypos,
 			  hb_uint32 *nPoints)
 {
-  return HB_Err_Ok; // TODO
+  return HB_Err_Ok; /* TODO */
 }
 
 static void
@@ -230,8 +230,8 @@ _hb_old_shaper_font_data_create (hb_font_t *font)
   data->klass = &hb_old_font_class;
   data->x_ppem = font->x_ppem;
   data->y_ppem = font->y_ppem;
-  data->x_scale = font->x_scale; // XXX
-  data->y_scale = font->y_scale; // XXX
+  data->x_scale = font->x_scale; /* XXX */
+  data->y_scale = font->y_scale; /* XXX */
   data->userData = font;
 
   return data;
@@ -251,15 +251,15 @@ _hb_old_shaper_font_data_destroy (hb_old_shaper_font_data_t *data)
 struct hb_old_shaper_shape_plan_data_t {};
 
 hb_old_shaper_shape_plan_data_t *
-_hb_old_shaper_shape_plan_data_create (hb_shape_plan_t    *shape_plan,
-				       const hb_feature_t *user_features,
-				       unsigned int        num_user_features)
+_hb_old_shaper_shape_plan_data_create (hb_shape_plan_t    *shape_plan HB_UNUSED,
+				       const hb_feature_t *user_features HB_UNUSED,
+				       unsigned int        num_user_features HB_UNUSED)
 {
   return (hb_old_shaper_shape_plan_data_t *) HB_SHAPER_DATA_SUCCEEDED;
 }
 
 void
-_hb_old_shaper_shape_plan_data_destroy (hb_old_shaper_shape_plan_data_t *data)
+_hb_old_shaper_shape_plan_data_destroy (hb_old_shaper_shape_plan_data_t *data HB_UNUSED)
 {
 }
 
@@ -269,7 +269,7 @@ _hb_old_shaper_shape_plan_data_destroy (hb_old_shaper_shape_plan_data_t *data)
  */
 
 hb_bool_t
-_hb_old_shape (hb_shape_plan_t    *shape_plan,
+_hb_old_shape (hb_shape_plan_t    *shape_plan HB_UNUSED,
 	       hb_font_t          *font,
 	       hb_buffer_t        *buffer,
 	       const hb_feature_t *features,
@@ -369,7 +369,7 @@ retry:
     *p = MIN (*p, buffer->info[i].cluster);
   }
   for (unsigned int i = 1; i < num_glyphs; i++)
-    if (vis_clusters[i] == -1)
+    if (vis_clusters[i] == (uint32_t) -1)
       vis_clusters[i] = vis_clusters[i - 1];
 
 #undef utf16_index
diff --git a/gfx/harfbuzz/src/hb-open-file-private.hh b/gfx/harfbuzz/src/hb-open-file-private.hh
index 31fedfbbceab..250504ae20b3 100644
--- a/gfx/harfbuzz/src/hb-open-file-private.hh
+++ b/gfx/harfbuzz/src/hb-open-file-private.hh
@@ -54,7 +54,7 @@ struct TTCHeader;
 typedef struct TableRecord
 {
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this));
   }
 
@@ -103,7 +103,7 @@ typedef struct OffsetTable
 
   public:
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this) && c->check_array (tables, TableRecord::static_size, numTables));
   }
 
@@ -131,7 +131,7 @@ struct TTCHeaderVersion1
   inline const OpenTypeFontFace& get_face (unsigned int i) const { return this+table[i]; }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (table.sanitize (c, this));
   }
 
@@ -170,7 +170,7 @@ struct TTCHeader
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (unlikely (!u.header.version.sanitize (c))) return TRACE_RETURN (false);
     switch (u.header.version.major) {
     case 2: /* version 2 is compatible with version 1 */
@@ -232,7 +232,7 @@ struct OpenTypeFontFile
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (unlikely (!u.tag.sanitize (c))) return TRACE_RETURN (false);
     switch (u.tag) {
     case CFFTag:	/* All the non-collection tags */
@@ -255,7 +255,7 @@ struct OpenTypeFontFile
 };
 
 
-} // namespace OT
+} /* namespace OT */
 
 
 #endif /* HB_OPEN_FILE_PRIVATE_HH */
diff --git a/gfx/harfbuzz/src/hb-open-type-private.hh b/gfx/harfbuzz/src/hb-open-type-private.hh
index 8595038d74cb..5bfeb1654703 100644
--- a/gfx/harfbuzz/src/hb-open-type-private.hh
+++ b/gfx/harfbuzz/src/hb-open-type-private.hh
@@ -37,6 +37,7 @@
 namespace OT {
 
 
+
 /*
  * Casts
  */
@@ -165,12 +166,22 @@ ASSERT_STATIC (Type::min_size + 1 <= sizeof (_Null##Type))
 #endif
 
 
-#define TRACE_SANITIZE() \
-	hb_auto_trace_t<HB_DEBUG_SANITIZE> trace (&c->debug_depth, "SANITIZE", this, HB_FUNC, "");
+#define TRACE_SANITIZE(this) \
+	hb_auto_trace_t<HB_DEBUG_SANITIZE, bool> trace \
+	(&c->debug_depth, c->get_name (), this, HB_FUNC, \
+	 "");
 
 
 struct hb_sanitize_context_t
 {
+  inline const char *get_name (void) { return "SANITIZE"; }
+  static const unsigned int max_debug_depth = HB_DEBUG_SANITIZE;
+  typedef bool return_t;
+  template <typename T>
+  inline return_t process (const T &obj) { return obj.sanitize (this); }
+  static return_t default_return_value (void) { return true; }
+  bool stop_sublookup_iteration (const return_t r HB_UNUSED) const { return false; }
+
   inline void init (hb_blob_t *b)
   {
     this->blob = hb_blob_reference (b);
@@ -205,10 +216,11 @@ struct hb_sanitize_context_t
   {
     const char *p = (const char *) base;
 
-    hb_auto_trace_t<HB_DEBUG_SANITIZE> trace (&this->debug_depth, "SANITIZE", this->blob, NULL,
-					      "check_range [%p..%p] (%d bytes) in [%p..%p]",
-					      p, p + len, len,
-					      this->start, this->end);
+    hb_auto_trace_t<HB_DEBUG_SANITIZE, bool> trace
+      (&this->debug_depth, "SANITIZE", this->blob, NULL,
+       "check_range [%p..%p] (%d bytes) in [%p..%p]",
+       p, p + len, len,
+       this->start, this->end);
 
     return TRACE_RETURN (likely (this->start <= p && p <= this->end && (unsigned int) (this->end - p) >= len));
   }
@@ -218,10 +230,11 @@ struct hb_sanitize_context_t
     const char *p = (const char *) base;
     bool overflows = _hb_unsigned_int_mul_overflows (len, record_size);
 
-    hb_auto_trace_t<HB_DEBUG_SANITIZE> trace (&this->debug_depth, "SANITIZE", this->blob, NULL,
-					      "check_array [%p..%p] (%d*%d=%ld bytes) in [%p..%p]",
-					      p, p + (record_size * len), record_size, len, (unsigned long) record_size * len,
-					      this->start, this->end);
+    hb_auto_trace_t<HB_DEBUG_SANITIZE, bool> trace
+      (&this->debug_depth, "SANITIZE", this->blob, NULL,
+       "check_array [%p..%p] (%d*%d=%ld bytes) in [%p..%p]",
+       p, p + (record_size * len), record_size, len, (unsigned long) record_size * len,
+       this->start, this->end);
 
     return TRACE_RETURN (likely (!overflows && this->check_range (base, record_size * len)));
   }
@@ -237,11 +250,13 @@ struct hb_sanitize_context_t
     const char *p = (const char *) base;
     this->edit_count++;
 
-    hb_auto_trace_t<HB_DEBUG_SANITIZE> trace (&this->debug_depth, "SANITIZE", this->blob, NULL,
-					      "may_edit(%u) [%p..%p] (%d bytes) in [%p..%p] -> %s",
-					      this->edit_count,
-					      p, p + len, len,
-					      this->start, this->end);
+    hb_auto_trace_t<HB_DEBUG_SANITIZE, bool> trace
+      (&this->debug_depth, "SANITIZE", this->blob, NULL,
+       "may_edit(%u) [%p..%p] (%d bytes) in [%p..%p] -> %s",
+       this->edit_count,
+       p, p + len, len,
+       this->start, this->end,
+       this->writable ? "GRANTED" : "DENIED");
 
     return TRACE_RETURN (this->writable);
   }
@@ -336,8 +351,10 @@ struct Sanitizer
 #endif
 
 
-#define TRACE_SERIALIZE() \
-	hb_auto_trace_t<HB_DEBUG_SERIALIZE> trace (&c->debug_depth, "SERIALIZE", c, HB_FUNC, "");
+#define TRACE_SERIALIZE(this) \
+	hb_auto_trace_t<HB_DEBUG_SERIALIZE, bool> trace \
+	(&c->debug_depth, "SERIALIZE", c, HB_FUNC, \
+	 "");
 
 
 struct hb_serialize_context_t
@@ -518,32 +535,43 @@ struct BEInt<Type, 4>
   inline bool operator != (const BEInt<Type, 4>& o) const { return !(*this == o); }
   private: uint8_t v[4];
 };
+template <typename Type>
+struct BEInt<Type, 3>
+{
+  public:
+  inline void set (Type i) { hb_be_uint24_put (v,i); }
+  inline operator Type (void) const { return hb_be_uint24_get (v); }
+  inline bool operator == (const BEInt<Type, 3>& o) const { return hb_be_uint24_eq (v, o.v); }
+  inline bool operator != (const BEInt<Type, 3>& o) const { return !(*this == o); }
+  private: uint8_t v[3];
+};
 
 /* Integer types in big-endian order and no alignment requirement */
-template <typename Type>
+template <typename Type, unsigned int Size>
 struct IntType
 {
   inline void set (Type i) { v.set (i); }
   inline operator Type(void) const { return v; }
-  inline bool operator == (const IntType<Type> &o) const { return v == o.v; }
-  inline bool operator != (const IntType<Type> &o) const { return v != o.v; }
-  static inline int cmp (const IntType<Type> *a, const IntType<Type> *b) { return b->cmp (*a); }
-  inline int cmp (IntType<Type> va) const { Type a = va; Type b = v; return a < b ? -1 : a == b ? 0 : +1; }
+  inline bool operator == (const IntType<Type,Size> &o) const { return v == o.v; }
+  inline bool operator != (const IntType<Type,Size> &o) const { return v != o.v; }
+  static inline int cmp (const IntType<Type,Size> *a, const IntType<Type,Size> *b) { return b->cmp (*a); }
+  inline int cmp (IntType<Type,Size> va) const { Type a = va; Type b = v; return a < b ? -1 : a == b ? 0 : +1; }
   inline int cmp (Type a) const { Type b = v; return a < b ? -1 : a == b ? 0 : +1; }
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (likely (c->check_struct (this)));
   }
   protected:
-  BEInt<Type, sizeof (Type)> v;
+  BEInt<Type, Size> v;
   public:
-  DEFINE_SIZE_STATIC (sizeof (Type));
+  DEFINE_SIZE_STATIC (Size);
 };
 
-typedef IntType<uint16_t> USHORT;	/* 16-bit unsigned integer. */
-typedef IntType<int16_t>  SHORT;	/* 16-bit signed integer. */
-typedef IntType<uint32_t> ULONG;	/* 32-bit unsigned integer. */
-typedef IntType<int32_t>  LONG;		/* 32-bit signed integer. */
+typedef IntType<uint16_t, 2> USHORT;	/* 16-bit unsigned integer. */
+typedef IntType<int16_t,  2> SHORT;	/* 16-bit signed integer. */
+typedef IntType<uint32_t, 4> ULONG;	/* 32-bit unsigned integer. */
+typedef IntType<int32_t,  4> LONG;	/* 32-bit signed integer. */
+typedef IntType<uint32_t, 3> UINT24;	/* 24-bit unsigned integer. */
 
 /* 16-bit signed integer (SHORT) that describes a quantity in FUnits. */
 typedef SHORT FWORD;
@@ -556,7 +584,7 @@ typedef USHORT UFWORD;
 struct LONGDATETIME
 {
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (likely (c->check_struct (this)));
   }
   private:
@@ -620,7 +648,7 @@ struct FixedVersion
   inline uint32_t to_int (void) const { return (major << 16) + minor; }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this));
   }
 
@@ -660,7 +688,7 @@ struct GenericOffsetTo : OffsetType
   }
 
   inline bool sanitize (hb_sanitize_context_t *c, void *base) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (unlikely (!c->check_struct (this))) return TRACE_RETURN (false);
     unsigned int offset = *this;
     if (unlikely (!offset)) return TRACE_RETURN (true);
@@ -669,7 +697,7 @@ struct GenericOffsetTo : OffsetType
   }
   template <typename T>
   inline bool sanitize (hb_sanitize_context_t *c, void *base, T user_data) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (unlikely (!c->check_struct (this))) return TRACE_RETURN (false);
     unsigned int offset = *this;
     if (unlikely (!offset)) return TRACE_RETURN (true);
@@ -677,7 +705,13 @@ struct GenericOffsetTo : OffsetType
     return TRACE_RETURN (likely (obj.sanitize (c, user_data)) || neuter (c));
   }
 
-  private:
+  inline bool try_set (hb_sanitize_context_t *c, const OffsetType &v) {
+    if (c->may_edit (this, this->static_size)) {
+      this->set (v);
+      return true;
+    }
+    return false;
+  }
   /* Set the offset to Null */
   inline bool neuter (hb_sanitize_context_t *c) {
     if (c->may_edit (this, this->static_size)) {
@@ -733,7 +767,7 @@ struct GenericArrayOf
   inline bool serialize (hb_serialize_context_t *c,
 			 unsigned int items_len)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (*this))) return TRACE_RETURN (false);
     len.set (items_len); /* TODO(serialize) Overflow? */
     if (unlikely (!c->extend (*this))) return TRACE_RETURN (false);
@@ -744,7 +778,7 @@ struct GenericArrayOf
 			 Supplier<Type> &items,
 			 unsigned int items_len)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!serialize (c, items_len))) return TRACE_RETURN (false);
     for (unsigned int i = 0; i < items_len; i++)
       array[i] = items[i];
@@ -753,7 +787,7 @@ struct GenericArrayOf
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (unlikely (!sanitize_shallow (c))) return TRACE_RETURN (false);
 
     /* Note: for structs that do not reference other structs,
@@ -768,7 +802,7 @@ struct GenericArrayOf
     return TRACE_RETURN (true);
   }
   inline bool sanitize (hb_sanitize_context_t *c, void *base) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (unlikely (!sanitize_shallow (c))) return TRACE_RETURN (false);
     unsigned int count = len;
     for (unsigned int i = 0; i < count; i++)
@@ -778,7 +812,7 @@ struct GenericArrayOf
   }
   template <typename T>
   inline bool sanitize (hb_sanitize_context_t *c, void *base, T user_data) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (unlikely (!sanitize_shallow (c))) return TRACE_RETURN (false);
     unsigned int count = len;
     for (unsigned int i = 0; i < count; i++)
@@ -789,7 +823,7 @@ struct GenericArrayOf
 
   private:
   inline bool sanitize_shallow (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this) && c->check_array (this, Type::static_size, len));
   }
 
@@ -831,12 +865,12 @@ struct OffsetListOf : OffsetArrayOf<Type>
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (OffsetArrayOf<Type>::sanitize (c, this));
   }
   template <typename T>
   inline bool sanitize (hb_sanitize_context_t *c, T user_data) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (OffsetArrayOf<Type>::sanitize (c, this, user_data));
   }
 };
@@ -859,7 +893,7 @@ struct HeadlessArrayOf
 			 Supplier<Type> &items,
 			 unsigned int items_len)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (*this))) return TRACE_RETURN (false);
     len.set (items_len); /* TODO(serialize) Overflow? */
     if (unlikely (!items_len)) return TRACE_RETURN (true);
@@ -876,7 +910,7 @@ struct HeadlessArrayOf
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (unlikely (!sanitize_shallow (c))) return TRACE_RETURN (false);
 
     /* Note: for structs that do not reference other structs,
@@ -922,7 +956,7 @@ struct SortedArrayOf : ArrayOf<Type> {
 };
 
 
-} // namespace OT
+} /* namespace OT */
 
 
 #endif /* HB_OPEN_TYPE_PRIVATE_HH */
diff --git a/gfx/harfbuzz/src/hb-ot-head-table.hh b/gfx/harfbuzz/src/hb-ot-head-table.hh
index 39495310aa9d..3a9451295de8 100644
--- a/gfx/harfbuzz/src/hb-ot-head-table.hh
+++ b/gfx/harfbuzz/src/hb-ot-head-table.hh
@@ -52,7 +52,7 @@ struct head
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this) && likely (version.major == 1));
   }
 
@@ -143,7 +143,7 @@ struct head
 };
 
 
-} // namespace OT
+} /* namespace OT */
 
 
 #endif /* HB_OT_HEAD_TABLE_HH */
diff --git a/gfx/harfbuzz/src/hb-ot-hhea-table.hh b/gfx/harfbuzz/src/hb-ot-hhea-table.hh
index 5009e6b6a2df..2b89c4e0208b 100644
--- a/gfx/harfbuzz/src/hb-ot-hhea-table.hh
+++ b/gfx/harfbuzz/src/hb-ot-hhea-table.hh
@@ -45,7 +45,7 @@ struct hhea
   static const hb_tag_t Tag	= HB_OT_TAG_hhea;
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this) && likely (version.major == 1));
   }
 
@@ -91,7 +91,7 @@ struct hhea
 };
 
 
-} // namespace OT
+} /* namespace OT */
 
 
 #endif /* HB_OT_HHEA_TABLE_HH */
diff --git a/gfx/harfbuzz/src/hb-ot-hmtx-table.hh b/gfx/harfbuzz/src/hb-ot-hmtx-table.hh
index feb601680083..b94337d0be72 100644
--- a/gfx/harfbuzz/src/hb-ot-hmtx-table.hh
+++ b/gfx/harfbuzz/src/hb-ot-hmtx-table.hh
@@ -53,7 +53,7 @@ struct hmtx
   static const hb_tag_t Tag	= HB_OT_TAG_hmtx;
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     /* We don't check for anything specific here.  The users of the
      * struct do all the hard work... */
     return TRACE_RETURN (true);
@@ -86,7 +86,7 @@ struct hmtx
 };
 
 
-} // namespace OT
+} /* namespace OT */
 
 
 #endif /* HB_OT_HMTX_TABLE_HH */
diff --git a/gfx/harfbuzz/src/hb-ot-layout-common-private.hh b/gfx/harfbuzz/src/hb-ot-layout-common-private.hh
index bfb3bdbfd963..e6018db12435 100644
--- a/gfx/harfbuzz/src/hb-ot-layout-common-private.hh
+++ b/gfx/harfbuzz/src/hb-ot-layout-common-private.hh
@@ -60,9 +60,14 @@ struct Record
     return tag.cmp (a);
   }
 
+  struct sanitize_closure_t {
+    hb_tag_t tag;
+    void *list_base;
+  };
   inline bool sanitize (hb_sanitize_context_t *c, void *base) {
-    TRACE_SANITIZE ();
-    return TRACE_RETURN (c->check_struct (this) && offset.sanitize (c, base));
+    TRACE_SANITIZE (this);
+    const sanitize_closure_t closure = {tag, base};
+    return TRACE_RETURN (c->check_struct (this) && offset.sanitize (c, base, &closure));
   }
 
   Tag		tag;		/* 4-byte Tag identifier */
@@ -115,7 +120,7 @@ struct RecordListOf : RecordArrayOf<Type>
   { return this+RecordArrayOf<Type>::operator [](i).offset; }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (RecordArrayOf<Type>::sanitize (c, this));
   }
 };
@@ -129,7 +134,7 @@ struct RangeRecord
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this));
   }
 
@@ -192,8 +197,9 @@ struct LangSys
    return reqFeatureIndex;;
   }
 
-  inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+  inline bool sanitize (hb_sanitize_context_t *c,
+			const Record<LangSys>::sanitize_closure_t * = NULL) {
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this) && featureIndex.sanitize (c));
   }
 
@@ -230,8 +236,9 @@ struct Script
   inline bool has_default_lang_sys (void) const { return defaultLangSys != 0; }
   inline const LangSys& get_default_lang_sys (void) const { return this+defaultLangSys; }
 
-  inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+  inline bool sanitize (hb_sanitize_context_t *c,
+			const Record<Script>::sanitize_closure_t * = NULL) {
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (defaultLangSys.sanitize (c, this) && langSys.sanitize (c, this));
   }
 
@@ -249,6 +256,219 @@ struct Script
 typedef RecordListOf<Script> ScriptList;
 
 
+/* http://www.microsoft.com/typography/otspec/features_pt.htm#size */
+struct FeatureParamsSize
+{
+  inline bool sanitize (hb_sanitize_context_t *c) {
+    TRACE_SANITIZE (this);
+    if (unlikely (!c->check_struct (this))) return TRACE_RETURN (false);
+
+    /* This subtable has some "history", if you will.  Some earlier versions of
+     * Adobe tools calculated the offset of the FeatureParams sutable from the
+     * beginning of the FeatureList table!  Now, that is dealt with in the
+     * Feature implementation.  But we still need to be able to tell junk from
+     * real data.  Note: We don't check that the nameID actually exists.
+     *
+     * Read Roberts wrote on 9/15/06 on opentype-list@indx.co.uk :
+     *
+     * Yes, it is correct that a new version of the AFDKO (version 2.0) will be
+     * coming out soon, and that the makeotf program will build a font with a
+     * 'size' feature that is correct by the specification.
+     *
+     * The specification for this feature tag is in the "OpenType Layout Tag
+     * Registry". You can see a copy of this at:
+     * http://partners.adobe.com/public/developer/opentype/index_tag8.html#size
+     *
+     * Here is one set of rules to determine if the 'size' feature is built
+     * correctly, or as by the older versions of MakeOTF. You may be able to do
+     * better.
+     *
+     * Assume that the offset to the size feature is according to specification,
+     * and make the following value checks. If it fails, assume the the size
+     * feature is calculated as versions of MakeOTF before the AFDKO 2.0 built it.
+     * If this fails, reject the 'size' feature. The older makeOTF's calculated the
+     * offset from the beginning of the FeatureList table, rather than from the
+     * beginning of the 'size' Feature table.
+     *
+     * If "design size" == 0:
+     *     fails check
+     *
+     * Else if ("subfamily identifier" == 0 and
+     *     "range start" == 0 and
+     *     "range end" == 0 and
+     *     "range start" == 0 and
+     *     "menu name ID" == 0)
+     *     passes check: this is the format used when there is a design size
+     * specified, but there is no recommended size range.
+     *
+     * Else if ("design size" <  "range start" or
+     *     "design size" >   "range end" or
+     *     "range end" <= "range start" or
+     *     "menu name ID"  < 256 or
+     *     "menu name ID"  > 32767 or
+     *     menu name ID is not a name ID which is actually in the name table)
+     *     fails test
+     * Else
+     *     passes test.
+     */
+
+    if (!designSize)
+      return TRACE_RETURN (false);
+    else if (subfamilyID == 0 &&
+	     subfamilyNameID == 0 &&
+	     rangeStart == 0 &&
+	     rangeEnd == 0)
+      return TRACE_RETURN (true);
+    else if (designSize < rangeStart ||
+	     designSize > rangeEnd ||
+	     subfamilyNameID < 256 ||
+	     subfamilyNameID > 32767)
+      return TRACE_RETURN (false);
+    else
+      return TRACE_RETURN (true);
+  }
+
+  USHORT	designSize;	/* Represents the design size in 720/inch
+				 * units (decipoints).  The design size entry
+				 * must be non-zero.  When there is a design
+				 * size but no recommended size range, the
+				 * rest of the array will consist of zeros. */
+  USHORT	subfamilyID;	/* Has no independent meaning, but serves
+				 * as an identifier that associates fonts
+				 * in a subfamily. All fonts which share a
+				 * Preferred or Font Family name and which
+				 * differ only by size range shall have the
+				 * same subfamily value, and no fonts which
+				 * differ in weight or style shall have the
+				 * same subfamily value. If this value is
+				 * zero, the remaining fields in the array
+				 * will be ignored. */
+  USHORT	subfamilyNameID;/* If the preceding value is non-zero, this
+				 * value must be set in the range 256 - 32767
+				 * (inclusive). It records the value of a
+				 * field in the name table, which must
+				 * contain English-language strings encoded
+				 * in Windows Unicode and Macintosh Roman,
+				 * and may contain additional strings
+				 * localized to other scripts and languages.
+				 * Each of these strings is the name an
+				 * application should use, in combination
+				 * with the family name, to represent the
+				 * subfamily in a menu.  Applications will
+				 * choose the appropriate version based on
+				 * their selection criteria. */
+  USHORT	rangeStart;	/* Large end of the recommended usage range
+				 * (inclusive), stored in 720/inch units
+				 * (decipoints). */
+  USHORT	rangeEnd;	/* Small end of the recommended usage range
+				   (exclusive), stored in 720/inch units
+				 * (decipoints). */
+  public:
+  DEFINE_SIZE_STATIC (10);
+};
+
+/* http://www.microsoft.com/typography/otspec/features_pt.htm#ssxx */
+struct FeatureParamsStylisticSet
+{
+  inline bool sanitize (hb_sanitize_context_t *c) {
+    TRACE_SANITIZE (this);
+    /* Right now minorVersion is at zero.  Which means, any table supports
+     * the uiNameID field. */
+    return TRACE_RETURN (c->check_struct (this));
+  }
+
+  USHORT	minorVersion;	/* (set to 0): This corresponds to a “minor”
+				 * version number. Additional data may be
+				 * added to the end of this Feature Parameters
+				 * table in the future. */
+
+  USHORT	uiNameID;	/* The 'name' table name ID that specifies a
+				 * string (or strings, for multiple languages)
+				 * for a user-interface label for this
+				 * feature.  The values of uiLabelNameId and
+				 * sampleTextNameId are expected to be in the
+				 * font-specific name ID range (256-32767),
+				 * though that is not a requirement in this
+				 * Feature Parameters specification. The
+				 * user-interface label for the feature can
+				 * be provided in multiple languages. An
+				 * English string should be included as a
+				 * fallback. The string should be kept to a
+				 * minimal length to fit comfortably with
+				 * different application interfaces. */
+  public:
+  DEFINE_SIZE_STATIC (4);
+};
+
+struct FeatureParamsCharacterVariants
+{
+  inline bool sanitize (hb_sanitize_context_t *c) {
+    TRACE_SANITIZE (this);
+    return TRACE_RETURN (c->check_struct (this) &&
+			 characters.sanitize (c));
+  }
+
+  USHORT	format;			/* Format number is set to 0. */
+  USHORT	featUILableNameID;	/* The ‘name’ table name ID that
+					 * specifies a string (or strings,
+					 * for multiple languages) for a
+					 * user-interface label for this
+					 * feature. (May be NULL.) */
+  USHORT	featUITooltipTextNameID;/* The ‘name’ table name ID that
+					 * specifies a string (or strings,
+					 * for multiple languages) that an
+					 * application can use for tooltip
+					 * text for this feature. (May be
+					 * NULL.) */
+  USHORT	sampleTextNameID;	/* The ‘name’ table name ID that
+					 * specifies sample text that
+					 * illustrates the effect of this
+					 * feature. (May be NULL.) */
+  USHORT	numNamedParameters;	/* Number of named parameters. (May
+					 * be zero.) */
+  USHORT	firstParamUILabelNameID;/* The first ‘name’ table name ID
+					 * used to specify strings for
+					 * user-interface labels for the
+					 * feature parameters. (Must be zero
+					 * if numParameters is zero.) */
+  ArrayOf<UINT24>
+		characters;		/* Array of the Unicode Scalar Value
+					 * of the characters for which this
+					 * feature provides glyph variants.
+					 * (May be zero.) */
+  public:
+  DEFINE_SIZE_ARRAY (14, characters);
+};
+
+struct FeatureParams
+{
+  inline bool sanitize (hb_sanitize_context_t *c, hb_tag_t tag) {
+    TRACE_SANITIZE (this);
+    if (tag == HB_TAG ('s','i','z','e'))
+      return TRACE_RETURN (u.size.sanitize (c));
+    if ((tag & 0xFFFF0000) == HB_TAG ('s','s','\0','\0')) /* ssXX */
+      return TRACE_RETURN (u.stylisticSet.sanitize (c));
+    if ((tag & 0xFFFF0000) == HB_TAG ('c','v','\0','\0')) /* cvXX */
+      return TRACE_RETURN (u.characterVariants.sanitize (c));
+    return TRACE_RETURN (true);
+  }
+
+  inline const FeatureParamsSize& get_size_params (hb_tag_t tag) const
+  {
+    if (tag == HB_TAG ('s','i','z','e'))
+      return u.size;
+    return Null(FeatureParamsSize);
+  }
+
+  private:
+  union {
+  FeatureParamsSize			size;
+  FeatureParamsStylisticSet		stylisticSet;
+  FeatureParamsCharacterVariants	characterVariants;
+  } u;
+  DEFINE_SIZE_STATIC (17);
+};
+
 struct Feature
 {
   inline unsigned int get_lookup_count (void) const
@@ -260,12 +480,54 @@ struct Feature
 					  unsigned int *lookup_tags /* OUT */) const
   { return lookupIndex.get_indexes (start_index, lookup_count, lookup_tags); }
 
-  inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
-    return TRACE_RETURN (c->check_struct (this) && lookupIndex.sanitize (c));
+  inline const FeatureParams &get_feature_params (void) const
+  { return this+featureParams; }
+
+  inline bool sanitize (hb_sanitize_context_t *c,
+			const Record<Feature>::sanitize_closure_t *closure) {
+    TRACE_SANITIZE (this);
+    if (unlikely (!(c->check_struct (this) && lookupIndex.sanitize (c))))
+      return TRACE_RETURN (false);
+
+    /* Some earlier versions of Adobe tools calculated the offset of the
+     * FeatureParams subtable from the beginning of the FeatureList table!
+     *
+     * If sanitizing "failed" for the FeatureParams subtable, try it with the
+     * alternative location.  We would know sanitize "failed" if old value
+     * of the offset was non-zero, but it's zeroed now.
+     *
+     * Only do this for the 'size' feature, since at the time of the faulty
+     * Adobe tools, only the 'size' feature had FeatureParams defined.
+     */
+
+    Offset orig_offset = featureParams;
+    if (unlikely (!featureParams.sanitize (c, this, closure ? closure->tag : HB_TAG_NONE)))
+      return TRACE_RETURN (false);
+
+    if (likely (!orig_offset))
+      return TRACE_RETURN (true);
+
+    if (featureParams == 0 && closure &&
+	closure->tag == HB_TAG ('s','i','z','e') &&
+	closure->list_base && closure->list_base < this)
+    {
+      unsigned int new_offset_int = (unsigned int) orig_offset -
+				    ((char *) this - (char *) closure->list_base);
+
+      Offset new_offset;
+      /* Check that it did not overflow. */
+      new_offset.set (new_offset_int);
+      if (new_offset == new_offset_int &&
+	  featureParams.try_set (c, new_offset) &&
+	  !featureParams.sanitize (c, this, closure ? closure->tag : HB_TAG_NONE))
+	return TRACE_RETURN (false);
+    }
+
+    return TRACE_RETURN (true);
   }
 
-  Offset	featureParams;	/* Offset to Feature Parameters table (if one
+  OffsetTo<FeatureParams>
+		 featureParams;	/* Offset to Feature Parameters table (if one
 				 * has been defined for the feature), relative
 				 * to the beginning of the Feature Table; = Null
 				 * if not required */
@@ -318,7 +580,7 @@ struct Lookup
 			 uint32_t lookup_props,
 			 unsigned int num_subtables)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (*this))) return TRACE_RETURN (false);
     lookupType.set (lookup_type);
     lookupFlag.set (lookup_props & 0xFFFF);
@@ -332,7 +594,7 @@ struct Lookup
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     /* Real sanitize of the subtables is done by GSUB/GPOS/... */
     if (!(c->check_struct (this) && subTable.sanitize (c))) return TRACE_RETURN (false);
     if (lookupFlag & LookupFlag::UseMarkFilteringSet)
@@ -377,7 +639,7 @@ struct CoverageFormat1
 			 Supplier<GlyphID> &glyphs,
 			 unsigned int num_glyphs)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (*this))) return TRACE_RETURN (false);
     glyphArray.len.set (num_glyphs);
     if (unlikely (!c->extend (glyphArray))) return TRACE_RETURN (false);
@@ -388,7 +650,7 @@ struct CoverageFormat1
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (glyphArray.sanitize (c));
   }
 
@@ -445,7 +707,7 @@ struct CoverageFormat2
 			 Supplier<GlyphID> &glyphs,
 			 unsigned int num_glyphs)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (*this))) return TRACE_RETURN (false);
 
     if (unlikely (!num_glyphs)) return TRACE_RETURN (true);
@@ -474,7 +736,7 @@ struct CoverageFormat2
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (rangeRecord.sanitize (c));
   }
 
@@ -541,8 +803,6 @@ struct CoverageFormat2
 
 struct Coverage
 {
-  inline unsigned int operator () (hb_codepoint_t glyph_id) const { return get_coverage (glyph_id); }
-
   inline unsigned int get_coverage (hb_codepoint_t glyph_id) const
   {
     switch (u.format) {
@@ -556,7 +816,7 @@ struct Coverage
 			 Supplier<GlyphID> &glyphs,
 			 unsigned int num_glyphs)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (*this))) return TRACE_RETURN (false);
     unsigned int num_ranges = 1;
     for (unsigned int i = 1; i < num_glyphs; i++)
@@ -571,7 +831,7 @@ struct Coverage
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -682,10 +942,18 @@ struct ClassDefFormat1
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this) && classValue.sanitize (c));
   }
 
+  template <typename set_t>
+  inline void add_class (set_t *glyphs, unsigned int klass) const {
+    unsigned int count = classValue.len;
+    for (unsigned int i = 0; i < count; i++)
+      if (classValue[i] == klass)
+        glyphs->add (startGlyph + i);
+  }
+
   inline bool intersects_class (const hb_set_t *glyphs, unsigned int klass) const {
     unsigned int count = classValue.len;
     for (unsigned int i = 0; i < count; i++)
@@ -717,10 +985,18 @@ struct ClassDefFormat2
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (rangeRecord.sanitize (c));
   }
 
+  template <typename set_t>
+  inline void add_class (set_t *glyphs, unsigned int klass) const {
+    unsigned int count = rangeRecord.len;
+    for (unsigned int i = 0; i < count; i++)
+      if (rangeRecord[i].value == klass)
+        rangeRecord[i].add_coverage (glyphs);
+  }
+
   inline bool intersects_class (const hb_set_t *glyphs, unsigned int klass) const {
     unsigned int count = rangeRecord.len;
     for (unsigned int i = 0; i < count; i++)
@@ -740,8 +1016,6 @@ struct ClassDefFormat2
 
 struct ClassDef
 {
-  inline unsigned int operator () (hb_codepoint_t glyph_id) const { return get_class (glyph_id); }
-
   inline unsigned int get_class (hb_codepoint_t glyph_id) const
   {
     switch (u.format) {
@@ -752,7 +1026,7 @@ struct ClassDef
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -761,6 +1035,14 @@ struct ClassDef
     }
   }
 
+  inline void add_class (hb_set_t *glyphs, unsigned int klass) const {
+    switch (u.format) {
+    case 1: u.format1.add_class (glyphs, klass); return;
+    case 2: u.format2.add_class (glyphs, klass); return;
+    default:return;
+    }
+  }
+
   inline bool intersects_class (const hb_set_t *glyphs, unsigned int klass) const {
     switch (u.format) {
     case 1: return u.format1.intersects_class (glyphs, klass);
@@ -836,7 +1118,7 @@ struct Device
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this) && c->check_range (this, this->get_size ()));
   }
 
@@ -854,7 +1136,7 @@ struct Device
 };
 
 
-} // namespace OT
+} /* namespace OT */
 
 
 #endif /* HB_OT_LAYOUT_COMMON_PRIVATE_HH */
diff --git a/gfx/harfbuzz/src/hb-ot-layout-gdef-table.hh b/gfx/harfbuzz/src/hb-ot-layout-gdef-table.hh
index 92ae1cf581b8..ff2d09c51f0f 100644
--- a/gfx/harfbuzz/src/hb-ot-layout-gdef-table.hh
+++ b/gfx/harfbuzz/src/hb-ot-layout-gdef-table.hh
@@ -51,7 +51,7 @@ struct AttachList
 					 unsigned int *point_count /* IN/OUT */,
 					 unsigned int *point_array /* OUT */) const
   {
-    unsigned int index = (this+coverage) (glyph_id);
+    unsigned int index = (this+coverage).get_coverage (glyph_id);
     if (index == NOT_COVERED)
     {
       if (point_count)
@@ -72,7 +72,7 @@ struct AttachList
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (coverage.sanitize (c, this) && attachPoint.sanitize (c, this));
   }
 
@@ -102,7 +102,7 @@ struct CaretValueFormat1
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this));
   }
 
@@ -128,7 +128,7 @@ struct CaretValueFormat2
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this));
   }
 
@@ -151,7 +151,7 @@ struct CaretValueFormat3
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this) && deviceTable.sanitize (c, this));
   }
 
@@ -179,7 +179,7 @@ struct CaretValue
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -220,7 +220,7 @@ struct LigGlyph
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (carets.sanitize (c, this));
   }
 
@@ -242,7 +242,7 @@ struct LigCaretList
 				      unsigned int *caret_count /* IN/OUT */,
 				      hb_position_t *caret_array /* OUT */) const
   {
-    unsigned int index = (this+coverage) (glyph_id);
+    unsigned int index = (this+coverage).get_coverage (glyph_id);
     if (index == NOT_COVERED)
     {
       if (caret_count)
@@ -254,7 +254,7 @@ struct LigCaretList
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (coverage.sanitize (c, this) && ligGlyph.sanitize (c, this));
   }
 
@@ -276,7 +276,7 @@ struct MarkGlyphSetsFormat1
   { return (this+coverage[set_index]).get_coverage (glyph_id) != NOT_COVERED; }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (coverage.sanitize (c, this));
   }
 
@@ -300,7 +300,7 @@ struct MarkGlyphSets
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -337,6 +337,8 @@ struct GDEF
   inline bool has_glyph_classes (void) const { return glyphClassDef != 0; }
   inline unsigned int get_glyph_class (hb_codepoint_t glyph) const
   { return (this+glyphClassDef).get_class (glyph); }
+  inline void get_glyphs_in_class (unsigned int klass, hb_set_t *glyphs) const
+  { (this+glyphClassDef).add_class (glyphs, klass); }
 
   inline bool has_mark_attachment_types (void) const { return markAttachClassDef != 0; }
   inline unsigned int get_mark_attachment_type (hb_codepoint_t glyph) const
@@ -363,7 +365,7 @@ struct GDEF
   { return version.to_int () >= 0x00010002 && (this+markGlyphSetsDef[0]).covers (set_index, glyph_id); }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (version.sanitize (c) &&
 			 likely (version.major == 1) &&
 			 glyphClassDef.sanitize (c, this) &&
@@ -383,13 +385,13 @@ struct GDEF
 
     switch (klass) {
     default:
-    case UnclassifiedGlyph:	return HB_OT_LAYOUT_GLYPH_CLASS_UNCLASSIFIED;
-    case BaseGlyph:		return HB_OT_LAYOUT_GLYPH_CLASS_BASE_GLYPH;
-    case LigatureGlyph:		return HB_OT_LAYOUT_GLYPH_CLASS_LIGATURE;
-    case ComponentGlyph:	return HB_OT_LAYOUT_GLYPH_CLASS_COMPONENT;
+    case UnclassifiedGlyph:	return HB_OT_LAYOUT_GLYPH_PROPS_UNCLASSIFIED;
+    case BaseGlyph:		return HB_OT_LAYOUT_GLYPH_PROPS_BASE_GLYPH;
+    case LigatureGlyph:		return HB_OT_LAYOUT_GLYPH_PROPS_LIGATURE;
+    case ComponentGlyph:	return HB_OT_LAYOUT_GLYPH_PROPS_COMPONENT;
     case MarkGlyph:
 	  klass = get_mark_attachment_type (glyph);
-	  return HB_OT_LAYOUT_GLYPH_CLASS_MARK | (klass << 8);
+	  return HB_OT_LAYOUT_GLYPH_PROPS_MARK | (klass << 8);
     }
   }
 
@@ -423,7 +425,7 @@ struct GDEF
 };
 
 
-} // namespace OT
+} /* namespace OT */
 
 
 #endif /* HB_OT_LAYOUT_GDEF_TABLE_HH */
diff --git a/gfx/harfbuzz/src/hb-ot-layout-gpos-table.hh b/gfx/harfbuzz/src/hb-ot-layout-gpos-table.hh
index 41cb93d02492..d27ce4f71eef 100644
--- a/gfx/harfbuzz/src/hb-ot-layout-gpos-table.hh
+++ b/gfx/harfbuzz/src/hb-ot-layout-gpos-table.hh
@@ -172,12 +172,12 @@ struct ValueFormat : USHORT
   }
 
   inline bool sanitize_value (hb_sanitize_context_t *c, void *base, Value *values) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_range (values, get_size ()) && (!has_device () || sanitize_value_devices (c, base, values)));
   }
 
   inline bool sanitize_values (hb_sanitize_context_t *c, void *base, Value *values, unsigned int count) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     unsigned int len = get_len ();
 
     if (!c->check_array (values, get_size (), count)) return TRACE_RETURN (false);
@@ -195,7 +195,7 @@ struct ValueFormat : USHORT
 
   /* Just sanitize referenced Device tables.  Doesn't check the values themselves. */
   inline bool sanitize_values_stride_unsafe (hb_sanitize_context_t *c, void *base, Value *values, unsigned int count, unsigned int stride) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
 
     if (!has_device ()) return TRACE_RETURN (true);
 
@@ -212,9 +212,6 @@ struct ValueFormat : USHORT
 
 struct AnchorFormat1
 {
-  friend struct Anchor;
-
-  private:
   inline void get_anchor (hb_font_t *font, hb_codepoint_t glyph_id HB_UNUSED,
 			  hb_position_t *x, hb_position_t *y) const
   {
@@ -223,7 +220,7 @@ struct AnchorFormat1
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this));
   }
 
@@ -237,9 +234,6 @@ struct AnchorFormat1
 
 struct AnchorFormat2
 {
-  friend struct Anchor;
-
-  private:
   inline void get_anchor (hb_font_t *font, hb_codepoint_t glyph_id,
 			  hb_position_t *x, hb_position_t *y) const
   {
@@ -255,7 +249,7 @@ struct AnchorFormat2
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this));
   }
 
@@ -270,9 +264,6 @@ struct AnchorFormat2
 
 struct AnchorFormat3
 {
-  friend struct Anchor;
-
-  private:
   inline void get_anchor (hb_font_t *font, hb_codepoint_t glyph_id HB_UNUSED,
 			  hb_position_t *x, hb_position_t *y) const
   {
@@ -286,7 +277,7 @@ struct AnchorFormat3
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this) && xDeviceTable.sanitize (c, this) && yDeviceTable.sanitize (c, this));
   }
 
@@ -321,7 +312,7 @@ struct Anchor
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -351,7 +342,7 @@ struct AnchorMatrix
   }
 
   inline bool sanitize (hb_sanitize_context_t *c, unsigned int cols) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!c->check_struct (this)) return TRACE_RETURN (false);
     if (unlikely (rows > 0 && cols >= ((unsigned int) -1) / rows)) return TRACE_RETURN (false);
     unsigned int count = rows * cols;
@@ -376,7 +367,7 @@ struct MarkRecord
   friend struct MarkArray;
 
   inline bool sanitize (hb_sanitize_context_t *c, void *base) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this) && markAnchor.sanitize (c, base));
   }
 
@@ -396,7 +387,7 @@ struct MarkArray : ArrayOf<MarkRecord>	/* Array of MarkRecords--in Coverage orde
 		     const AnchorMatrix &anchors, unsigned int class_count,
 		     unsigned int glyph_pos) const
   {
-    TRACE_APPLY ();
+    TRACE_APPLY (this);
     const MarkRecord &record = ArrayOf<MarkRecord>::operator[](mark_index);
     unsigned int mark_class = record.klass;
 
@@ -418,7 +409,7 @@ struct MarkArray : ArrayOf<MarkRecord>	/* Array of MarkRecords--in Coverage orde
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (ArrayOf<MarkRecord>::sanitize (c, this));
   }
 };
@@ -428,9 +419,11 @@ struct MarkArray : ArrayOf<MarkRecord>	/* Array of MarkRecords--in Coverage orde
 
 struct SinglePosFormat1
 {
-  friend struct SinglePos;
-
-  private:
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    (this+coverage).add_coverage (c->input);
+  }
 
   inline const Coverage &get_coverage (void) const
   {
@@ -439,8 +432,8 @@ struct SinglePosFormat1
 
   inline bool apply (hb_apply_context_t *c) const
   {
-    TRACE_APPLY ();
-    unsigned int index = (this+coverage) (c->buffer->cur().codepoint);
+    TRACE_APPLY (this);
+    unsigned int index = (this+coverage).get_coverage  (c->buffer->cur().codepoint);
     if (likely (index == NOT_COVERED)) return TRACE_RETURN (false);
 
     valueFormat.apply_value (c->font, c->direction, this,
@@ -451,7 +444,7 @@ struct SinglePosFormat1
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this) && coverage.sanitize (c, this) && valueFormat.sanitize_value (c, this, values));
   }
 
@@ -471,9 +464,11 @@ struct SinglePosFormat1
 
 struct SinglePosFormat2
 {
-  friend struct SinglePos;
-
-  private:
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    (this+coverage).add_coverage (c->input);
+  }
 
   inline const Coverage &get_coverage (void) const
   {
@@ -482,8 +477,8 @@ struct SinglePosFormat2
 
   inline bool apply (hb_apply_context_t *c) const
   {
-    TRACE_APPLY ();
-    unsigned int index = (this+coverage) (c->buffer->cur().codepoint);
+    TRACE_APPLY (this);
+    unsigned int index = (this+coverage).get_coverage  (c->buffer->cur().codepoint);
     if (likely (index == NOT_COVERED)) return TRACE_RETURN (false);
 
     if (likely (index >= valueCount)) return TRACE_RETURN (false);
@@ -497,7 +492,7 @@ struct SinglePosFormat2
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this) && coverage.sanitize (c, this) && valueFormat.sanitize_values (c, this, values, valueCount));
   }
 
@@ -517,31 +512,19 @@ struct SinglePosFormat2
 
 struct SinglePos
 {
-  friend struct PosLookupSubTable;
-
-  private:
-
-  inline const Coverage &get_coverage (void) const
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c) const
   {
+    TRACE_PROCESS (this);
     switch (u.format) {
-    case 1: return u.format1.get_coverage ();
-    case 2: return u.format2.get_coverage ();
-    default:return Null(Coverage);
-    }
-  }
-
-  inline bool apply (hb_apply_context_t *c) const
-  {
-    TRACE_APPLY ();
-    switch (u.format) {
-    case 1: return TRACE_RETURN (u.format1.apply (c));
-    case 2: return TRACE_RETURN (u.format2.apply (c));
-    default:return TRACE_RETURN (false);
+    case 1: return TRACE_RETURN (c->process (u.format1));
+    case 2: return TRACE_RETURN (c->process (u.format2));
+    default:return TRACE_RETURN (c->default_return_value ());
     }
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -577,17 +560,34 @@ struct PairSet
 {
   friend struct PairPosFormat1;
 
-  inline bool apply (hb_apply_context_t *c,
-		     const ValueFormat *valueFormats,
-		     unsigned int pos) const
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c,
+			      const ValueFormat *valueFormats) const
   {
-    TRACE_APPLY ();
+    TRACE_COLLECT_GLYPHS (this);
     unsigned int len1 = valueFormats[0].get_len ();
     unsigned int len2 = valueFormats[1].get_len ();
     unsigned int record_size = USHORT::static_size * (1 + len1 + len2);
 
-    unsigned int count = len;
     const PairValueRecord *record = CastP<PairValueRecord> (array);
+    unsigned int count = len;
+    for (unsigned int i = 0; i < count; i++)
+    {
+      c->input->add (record->secondGlyph);
+      record = &StructAtOffset<PairValueRecord> (record, record_size);
+    }
+  }
+
+  inline bool apply (hb_apply_context_t *c,
+		     const ValueFormat *valueFormats,
+		     unsigned int pos) const
+  {
+    TRACE_APPLY (this);
+    unsigned int len1 = valueFormats[0].get_len ();
+    unsigned int len2 = valueFormats[1].get_len ();
+    unsigned int record_size = USHORT::static_size * (1 + len1 + len2);
+
+    const PairValueRecord *record = CastP<PairValueRecord> (array);
+    unsigned int count = len;
     for (unsigned int i = 0; i < count; i++)
     {
       if (c->buffer->info[pos].codepoint == record->secondGlyph)
@@ -615,7 +615,7 @@ struct PairSet
   };
 
   inline bool sanitize (hb_sanitize_context_t *c, const sanitize_closure_t *closure) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!(c->check_struct (this)
        && c->check_array (array, USHORT::static_size * closure->stride, len))) return TRACE_RETURN (false);
 
@@ -635,9 +635,14 @@ struct PairSet
 
 struct PairPosFormat1
 {
-  friend struct PairPos;
-
-  private:
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    (this+coverage).add_coverage (c->input);
+    unsigned int count = pairSet.len;
+    for (unsigned int i = 0; i < count; i++)
+      (this+pairSet[i]).collect_glyphs (c, &valueFormat1);
+  }
 
   inline const Coverage &get_coverage (void) const
   {
@@ -646,11 +651,11 @@ struct PairPosFormat1
 
   inline bool apply (hb_apply_context_t *c) const
   {
-    TRACE_APPLY ();
+    TRACE_APPLY (this);
     hb_apply_context_t::mark_skipping_forward_iterator_t skippy_iter (c, c->buffer->idx, 1);
     if (skippy_iter.has_no_chance ()) return TRACE_RETURN (false);
 
-    unsigned int index = (this+coverage) (c->buffer->cur().codepoint);
+    unsigned int index = (this+coverage).get_coverage  (c->buffer->cur().codepoint);
     if (likely (index == NOT_COVERED)) return TRACE_RETURN (false);
 
     if (!skippy_iter.next ()) return TRACE_RETURN (false);
@@ -659,7 +664,7 @@ struct PairPosFormat1
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
 
     unsigned int len1 = valueFormat1.get_len ();
     unsigned int len2 = valueFormat2.get_len ();
@@ -693,9 +698,23 @@ struct PairPosFormat1
 
 struct PairPosFormat2
 {
-  friend struct PairPos;
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    /* (this+coverage).add_coverage (c->input); // Don't need this. */
 
-  private:
+    /* TODO only add values for pairs that have nonzero adjustments. */
+
+    unsigned int count1 = class1Count;
+    const ClassDef &klass1 = this+classDef1;
+    for (unsigned int i = 0; i < count1; i++)
+      klass1.add_class (c->input, i);
+
+    unsigned int count2 = class2Count;
+    const ClassDef &klass2 = this+classDef2;
+    for (unsigned int i = 0; i < count2; i++)
+      klass2.add_class (c->input, i);
+  }
 
   inline const Coverage &get_coverage (void) const
   {
@@ -704,11 +723,11 @@ struct PairPosFormat2
 
   inline bool apply (hb_apply_context_t *c) const
   {
-    TRACE_APPLY ();
+    TRACE_APPLY (this);
     hb_apply_context_t::mark_skipping_forward_iterator_t skippy_iter (c, c->buffer->idx, 1);
     if (skippy_iter.has_no_chance ()) return TRACE_RETURN (false);
 
-    unsigned int index = (this+coverage) (c->buffer->cur().codepoint);
+    unsigned int index = (this+coverage).get_coverage  (c->buffer->cur().codepoint);
     if (likely (index == NOT_COVERED)) return TRACE_RETURN (false);
 
     if (!skippy_iter.next ()) return TRACE_RETURN (false);
@@ -717,8 +736,8 @@ struct PairPosFormat2
     unsigned int len2 = valueFormat2.get_len ();
     unsigned int record_len = len1 + len2;
 
-    unsigned int klass1 = (this+classDef1) (c->buffer->cur().codepoint);
-    unsigned int klass2 = (this+classDef2) (c->buffer->info[skippy_iter.idx].codepoint);
+    unsigned int klass1 = (this+classDef1).get_class (c->buffer->cur().codepoint);
+    unsigned int klass2 = (this+classDef2).get_class (c->buffer->info[skippy_iter.idx].codepoint);
     if (unlikely (klass1 >= class1Count || klass2 >= class2Count)) return TRACE_RETURN (false);
 
     const Value *v = &values[record_len * (klass1 * class2Count + klass2)];
@@ -735,7 +754,7 @@ struct PairPosFormat2
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!(c->check_struct (this)
        && coverage.sanitize (c, this)
        && classDef1.sanitize (c, this)
@@ -783,31 +802,19 @@ struct PairPosFormat2
 
 struct PairPos
 {
-  friend struct PosLookupSubTable;
-
-  private:
-
-  inline const Coverage &get_coverage (void) const
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c) const
   {
+    TRACE_PROCESS (this);
     switch (u.format) {
-    case 1: return u.format1.get_coverage ();
-    case 2: return u.format2.get_coverage ();
-    default:return Null(Coverage);
-    }
-  }
-
-  inline bool apply (hb_apply_context_t *c) const
-  {
-    TRACE_APPLY ();
-    switch (u.format) {
-    case 1: return TRACE_RETURN (u.format1.apply (c));
-    case 2: return TRACE_RETURN (u.format2.apply (c));
-    default:return TRACE_RETURN (false);
+    case 1: return TRACE_RETURN (c->process (u.format1));
+    case 2: return TRACE_RETURN (c->process (u.format2));
+    default:return TRACE_RETURN (c->default_return_value ());
     }
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -830,7 +837,7 @@ struct EntryExitRecord
   friend struct CursivePosFormat1;
 
   inline bool sanitize (hb_sanitize_context_t *c, void *base) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (entryAnchor.sanitize (c, base) && exitAnchor.sanitize (c, base));
   }
 
@@ -849,9 +856,11 @@ struct EntryExitRecord
 
 struct CursivePosFormat1
 {
-  friend struct CursivePos;
-
-  private:
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    (this+coverage).add_coverage (c->input);
+  }
 
   inline const Coverage &get_coverage (void) const
   {
@@ -860,20 +869,20 @@ struct CursivePosFormat1
 
   inline bool apply (hb_apply_context_t *c) const
   {
-    TRACE_APPLY ();
+    TRACE_APPLY (this);
 
     /* We don't handle mark glyphs here. */
-    if (c->property & HB_OT_LAYOUT_GLYPH_CLASS_MARK) return TRACE_RETURN (false);
+    if (c->property & HB_OT_LAYOUT_GLYPH_PROPS_MARK) return TRACE_RETURN (false);
 
     hb_apply_context_t::mark_skipping_forward_iterator_t skippy_iter (c, c->buffer->idx, 1);
     if (skippy_iter.has_no_chance ()) return TRACE_RETURN (false);
 
-    const EntryExitRecord &this_record = entryExitRecord[(this+coverage) (c->buffer->cur().codepoint)];
+    const EntryExitRecord &this_record = entryExitRecord[(this+coverage).get_coverage  (c->buffer->cur().codepoint)];
     if (!this_record.exitAnchor) return TRACE_RETURN (false);
 
     if (!skippy_iter.next ()) return TRACE_RETURN (false);
 
-    const EntryExitRecord &next_record = entryExitRecord[(this+coverage) (c->buffer->info[skippy_iter.idx].codepoint)];
+    const EntryExitRecord &next_record = entryExitRecord[(this+coverage).get_coverage  (c->buffer->info[skippy_iter.idx].codepoint)];
     if (!next_record.entryAnchor) return TRACE_RETURN (false);
 
     unsigned int i = c->buffer->idx;
@@ -941,7 +950,7 @@ struct CursivePosFormat1
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (coverage.sanitize (c, this) && entryExitRecord.sanitize (c, this));
   }
 
@@ -959,29 +968,18 @@ struct CursivePosFormat1
 
 struct CursivePos
 {
-  friend struct PosLookupSubTable;
-
-  private:
-
-  inline const Coverage &get_coverage (void) const
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c) const
   {
+    TRACE_PROCESS (this);
     switch (u.format) {
-    case 1: return u.format1.get_coverage ();
-    default:return Null(Coverage);
-    }
-  }
-
-  inline bool apply (hb_apply_context_t *c) const
-  {
-    TRACE_APPLY ();
-    switch (u.format) {
-    case 1: return TRACE_RETURN (u.format1.apply (c));
-    default:return TRACE_RETURN (false);
+    case 1: return TRACE_RETURN (c->process (u.format1));
+    default:return TRACE_RETURN (c->default_return_value ());
     }
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -1004,9 +1002,13 @@ typedef AnchorMatrix BaseArray;		/* base-major--
 
 struct MarkBasePosFormat1
 {
-  friend struct MarkBasePos;
-
-  private:
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    (this+markCoverage).add_coverage (c->input);
+    (this+baseCoverage).add_coverage (c->input);
+    /* TODO only add combinations that have nonzero adjustment. */
+  }
 
   inline const Coverage &get_coverage (void) const
   {
@@ -1015,8 +1017,8 @@ struct MarkBasePosFormat1
 
   inline bool apply (hb_apply_context_t *c) const
   {
-    TRACE_APPLY ();
-    unsigned int mark_index = (this+markCoverage) (c->buffer->cur().codepoint);
+    TRACE_APPLY (this);
+    unsigned int mark_index = (this+markCoverage).get_coverage  (c->buffer->cur().codepoint);
     if (likely (mark_index == NOT_COVERED)) return TRACE_RETURN (false);
 
     /* now we search backwards for a non-mark glyph */
@@ -1030,16 +1032,16 @@ struct MarkBasePosFormat1
     } while (1);
 
     /* The following assertion is too strong, so we've disabled it. */
-    if (!(property & HB_OT_LAYOUT_GLYPH_CLASS_BASE_GLYPH)) {/*return TRACE_RETURN (false);*/}
+    if (!(property & HB_OT_LAYOUT_GLYPH_PROPS_BASE_GLYPH)) {/*return TRACE_RETURN (false);*/}
 
-    unsigned int base_index = (this+baseCoverage) (c->buffer->info[skippy_iter.idx].codepoint);
+    unsigned int base_index = (this+baseCoverage).get_coverage  (c->buffer->info[skippy_iter.idx].codepoint);
     if (base_index == NOT_COVERED) return TRACE_RETURN (false);
 
     return TRACE_RETURN ((this+markArray).apply (c, mark_index, base_index, this+baseArray, classCount, skippy_iter.idx));
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this) && markCoverage.sanitize (c, this) && baseCoverage.sanitize (c, this) &&
 			 markArray.sanitize (c, this) && baseArray.sanitize (c, this, (unsigned int) classCount));
   }
@@ -1065,29 +1067,18 @@ struct MarkBasePosFormat1
 
 struct MarkBasePos
 {
-  friend struct PosLookupSubTable;
-
-  private:
-
-  inline const Coverage &get_coverage (void) const
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c) const
   {
+    TRACE_PROCESS (this);
     switch (u.format) {
-    case 1: return u.format1.get_coverage ();
-    default:return Null(Coverage);
-    }
-  }
-
-  inline bool apply (hb_apply_context_t *c) const
-  {
-    TRACE_APPLY ();
-    switch (u.format) {
-    case 1: return TRACE_RETURN (u.format1.apply (c));
-    default:return TRACE_RETURN (false);
+    case 1: return TRACE_RETURN (c->process (u.format1));
+    default:return TRACE_RETURN (c->default_return_value ());
     }
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -1115,9 +1106,13 @@ typedef OffsetListOf<LigatureAttach> LigatureArray;
 
 struct MarkLigPosFormat1
 {
-  friend struct MarkLigPos;
-
-  private:
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    (this+markCoverage).add_coverage (c->input);
+    (this+ligatureCoverage).add_coverage (c->input);
+    /* TODO only add combinations that have nonzero adjustment. */
+  }
 
   inline const Coverage &get_coverage (void) const
   {
@@ -1126,8 +1121,8 @@ struct MarkLigPosFormat1
 
   inline bool apply (hb_apply_context_t *c) const
   {
-    TRACE_APPLY ();
-    unsigned int mark_index = (this+markCoverage) (c->buffer->cur().codepoint);
+    TRACE_APPLY (this);
+    unsigned int mark_index = (this+markCoverage).get_coverage  (c->buffer->cur().codepoint);
     if (likely (mark_index == NOT_COVERED)) return TRACE_RETURN (false);
 
     /* now we search backwards for a non-mark glyph */
@@ -1136,10 +1131,10 @@ struct MarkLigPosFormat1
     if (!skippy_iter.prev (&property, LookupFlag::IgnoreMarks)) return TRACE_RETURN (false);
 
     /* The following assertion is too strong, so we've disabled it. */
-    if (!(property & HB_OT_LAYOUT_GLYPH_CLASS_LIGATURE)) {/*return TRACE_RETURN (false);*/}
+    if (!(property & HB_OT_LAYOUT_GLYPH_PROPS_LIGATURE)) {/*return TRACE_RETURN (false);*/}
 
     unsigned int j = skippy_iter.idx;
-    unsigned int lig_index = (this+ligatureCoverage) (c->buffer->info[j].codepoint);
+    unsigned int lig_index = (this+ligatureCoverage).get_coverage  (c->buffer->info[j].codepoint);
     if (lig_index == NOT_COVERED) return TRACE_RETURN (false);
 
     const LigatureArray& lig_array = this+ligatureArray;
@@ -1166,7 +1161,7 @@ struct MarkLigPosFormat1
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this) && markCoverage.sanitize (c, this) && ligatureCoverage.sanitize (c, this) &&
 			 markArray.sanitize (c, this) && ligatureArray.sanitize (c, this, (unsigned int) classCount));
   }
@@ -1193,29 +1188,18 @@ struct MarkLigPosFormat1
 
 struct MarkLigPos
 {
-  friend struct PosLookupSubTable;
-
-  private:
-
-  inline const Coverage &get_coverage (void) const
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c) const
   {
+    TRACE_PROCESS (this);
     switch (u.format) {
-    case 1: return u.format1.get_coverage ();
-    default:return Null(Coverage);
-    }
-  }
-
-  inline bool apply (hb_apply_context_t *c) const
-  {
-    TRACE_APPLY ();
-    switch (u.format) {
-    case 1: return TRACE_RETURN (u.format1.apply (c));
-    default:return TRACE_RETURN (false);
+    case 1: return TRACE_RETURN (c->process (u.format1));
+    default:return TRACE_RETURN (c->default_return_value ());
     }
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -1238,9 +1222,13 @@ typedef AnchorMatrix Mark2Array;	/* mark2-major--
 
 struct MarkMarkPosFormat1
 {
-  friend struct MarkMarkPos;
-
-  private:
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    (this+mark1Coverage).add_coverage (c->input);
+    (this+mark2Coverage).add_coverage (c->input);
+    /* TODO only add combinations that have nonzero adjustment. */
+  }
 
   inline const Coverage &get_coverage (void) const
   {
@@ -1249,8 +1237,8 @@ struct MarkMarkPosFormat1
 
   inline bool apply (hb_apply_context_t *c) const
   {
-    TRACE_APPLY ();
-    unsigned int mark1_index = (this+mark1Coverage) (c->buffer->cur().codepoint);
+    TRACE_APPLY (this);
+    unsigned int mark1_index = (this+mark1Coverage).get_coverage  (c->buffer->cur().codepoint);
     if (likely (mark1_index == NOT_COVERED)) return TRACE_RETURN (false);
 
     /* now we search backwards for a suitable mark glyph until a non-mark glyph */
@@ -1258,7 +1246,7 @@ struct MarkMarkPosFormat1
     hb_apply_context_t::mark_skipping_backward_iterator_t skippy_iter (c, c->buffer->idx, 1);
     if (!skippy_iter.prev (&property)) return TRACE_RETURN (false);
 
-    if (!(property & HB_OT_LAYOUT_GLYPH_CLASS_MARK)) return TRACE_RETURN (false);
+    if (!(property & HB_OT_LAYOUT_GLYPH_PROPS_MARK)) return TRACE_RETURN (false);
 
     unsigned int j = skippy_iter.idx;
 
@@ -1283,14 +1271,14 @@ struct MarkMarkPosFormat1
     return TRACE_RETURN (false);
 
     good:
-    unsigned int mark2_index = (this+mark2Coverage) (c->buffer->info[j].codepoint);
+    unsigned int mark2_index = (this+mark2Coverage).get_coverage  (c->buffer->info[j].codepoint);
     if (mark2_index == NOT_COVERED) return TRACE_RETURN (false);
 
     return TRACE_RETURN ((this+mark1Array).apply (c, mark1_index, mark2_index, this+mark2Array, classCount, j));
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this) && mark1Coverage.sanitize (c, this) &&
 			 mark2Coverage.sanitize (c, this) && mark1Array.sanitize (c, this)
 			 && mark2Array.sanitize (c, this, (unsigned int) classCount));
@@ -1319,29 +1307,18 @@ struct MarkMarkPosFormat1
 
 struct MarkMarkPos
 {
-  friend struct PosLookupSubTable;
-
-  private:
-
-  inline const Coverage &get_coverage (void) const
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c) const
   {
+    TRACE_PROCESS (this);
     switch (u.format) {
-    case 1: return u.format1.get_coverage ();
-    default:return Null(Coverage);
-    }
-  }
-
-  inline bool apply (hb_apply_context_t *c) const
-  {
-    TRACE_APPLY ();
-    switch (u.format) {
-    case 1: return TRACE_RETURN (u.format1.apply (c));
-    default:return TRACE_RETURN (false);
+    case 1: return TRACE_RETURN (c->process (u.format1));
+    default:return TRACE_RETURN (c->default_return_value ());
     }
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -1357,50 +1334,13 @@ struct MarkMarkPos
 };
 
 
-static inline bool position_lookup (hb_apply_context_t *c, unsigned int lookup_index);
+struct ContextPos : Context {};
 
-struct ContextPos : Context
+struct ChainContextPos : ChainContext {};
+
+struct ExtensionPos : Extension<ExtensionPos>
 {
-  friend struct PosLookupSubTable;
-
-  private:
-  inline bool apply (hb_apply_context_t *c) const
-  {
-    TRACE_APPLY ();
-    return TRACE_RETURN (Context::apply (c, position_lookup));
-  }
-};
-
-struct ChainContextPos : ChainContext
-{
-  friend struct PosLookupSubTable;
-
-  private:
-  inline bool apply (hb_apply_context_t *c) const
-  {
-    TRACE_APPLY ();
-    return TRACE_RETURN (ChainContext::apply (c, position_lookup));
-  }
-};
-
-
-struct ExtensionPos : Extension
-{
-  friend struct PosLookupSubTable;
-
-  private:
-  inline const struct PosLookupSubTable& get_subtable (void) const
-  {
-    unsigned int offset = get_offset ();
-    if (unlikely (!offset)) return Null(PosLookupSubTable);
-    return StructAtOffset<PosLookupSubTable> (this, offset);
-  }
-
-  inline const Coverage &get_coverage (void) const;
-
-  inline bool apply (hb_apply_context_t *c) const;
-
-  inline bool sanitize (hb_sanitize_context_t *c);
+  typedef struct PosLookupSubTable LookupSubTable;
 };
 
 
@@ -1426,41 +1366,26 @@ struct PosLookupSubTable
     Extension		= 9
   };
 
-  inline const Coverage &get_coverage (unsigned int lookup_type) const
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c, unsigned int lookup_type) const
   {
+    TRACE_PROCESS (this);
     switch (lookup_type) {
-    case Single:		return u.single.get_coverage ();
-    case Pair:			return u.pair.get_coverage ();
-    case Cursive:		return u.cursive.get_coverage ();
-    case MarkBase:		return u.markBase.get_coverage ();
-    case MarkLig:		return u.markLig.get_coverage ();
-    case MarkMark:		return u.markMark.get_coverage ();
-    case Context:		return u.context.get_coverage ();
-    case ChainContext:		return u.chainContext.get_coverage ();
-    case Extension:		return u.extension.get_coverage ();
-    default:			return Null(Coverage);
-    }
-  }
-
-  inline bool apply (hb_apply_context_t *c, unsigned int lookup_type) const
-  {
-    TRACE_APPLY ();
-    switch (lookup_type) {
-    case Single:		return TRACE_RETURN (u.single.apply (c));
-    case Pair:			return TRACE_RETURN (u.pair.apply (c));
-    case Cursive:		return TRACE_RETURN (u.cursive.apply (c));
-    case MarkBase:		return TRACE_RETURN (u.markBase.apply (c));
-    case MarkLig:		return TRACE_RETURN (u.markLig.apply (c));
-    case MarkMark:		return TRACE_RETURN (u.markMark.apply (c));
-    case Context:		return TRACE_RETURN (u.context.apply (c));
-    case ChainContext:		return TRACE_RETURN (u.chainContext.apply (c));
-    case Extension:		return TRACE_RETURN (u.extension.apply (c));
-    default:			return TRACE_RETURN (false);
+    case Single:		return TRACE_RETURN (u.single.process (c));
+    case Pair:			return TRACE_RETURN (u.pair.process (c));
+    case Cursive:		return TRACE_RETURN (u.cursive.process (c));
+    case MarkBase:		return TRACE_RETURN (u.markBase.process (c));
+    case MarkLig:		return TRACE_RETURN (u.markLig.process (c));
+    case MarkMark:		return TRACE_RETURN (u.markMark.process (c));
+    case Context:		return TRACE_RETURN (u.context.process (c));
+    case ChainContext:		return TRACE_RETURN (u.chainContext.process (c));
+    case Extension:		return TRACE_RETURN (u.extension.process (c));
+    default:			return TRACE_RETURN (c->default_return_value ());
     }
   }
 
   inline bool sanitize (hb_sanitize_context_t *c, unsigned int lookup_type) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.header.sub_format.sanitize (c))
       return TRACE_RETURN (false);
     switch (lookup_type) {
@@ -1480,7 +1405,7 @@ struct PosLookupSubTable
   protected:
   union {
   struct {
-    USHORT			sub_format;
+    USHORT		sub_format;
   } header;
   SinglePos		single;
   PairPos		pair;
@@ -1502,35 +1427,54 @@ struct PosLookup : Lookup
   inline const PosLookupSubTable& get_subtable (unsigned int i) const
   { return this+CastR<OffsetArrayOf<PosLookupSubTable> > (subTable)[i]; }
 
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c) const
+  {
+    TRACE_PROCESS (this);
+    unsigned int lookup_type = get_type ();
+    unsigned int count = get_subtable_count ();
+    for (unsigned int i = 0; i < count; i++) {
+      typename context_t::return_t r = get_subtable (i).process (c, lookup_type);
+      if (c->stop_sublookup_iteration (r))
+        return TRACE_RETURN (r);
+    }
+    return TRACE_RETURN (c->default_return_value ());
+  }
+  template <typename context_t>
+  static inline typename context_t::return_t process_recurse_func (context_t *c, unsigned int lookup_index);
+
+  inline hb_collect_glyphs_context_t::return_t collect_glyphs_lookup (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    c->set_recurse_func (NULL);
+    return TRACE_RETURN (process (c));
+  }
+
   template <typename set_t>
   inline void add_coverage (set_t *glyphs) const
   {
+    hb_get_coverage_context_t c;
     const Coverage *last = NULL;
     unsigned int count = get_subtable_count ();
     for (unsigned int i = 0; i < count; i++) {
-      const Coverage *c = &get_subtable (i).get_coverage (get_type ());
-      if (c != last) {
-        c->add_coverage (glyphs);
-        last = c;
+      const Coverage *coverage = &get_subtable (i).process (&c, get_type ());
+      if (coverage != last) {
+        coverage->add_coverage (glyphs);
+        last = coverage;
       }
     }
   }
 
   inline bool apply_once (hb_apply_context_t *c) const
   {
-    unsigned int lookup_type = get_type ();
-
+    TRACE_APPLY (this);
     if (!c->check_glyph_property (&c->buffer->cur(), c->lookup_props, &c->property))
-      return false;
-
-    unsigned int count = get_subtable_count ();
-    for (unsigned int i = 0; i < count; i++)
-      if (get_subtable (i).apply (c, lookup_type))
-	return true;
-
-    return false;
+      return TRACE_RETURN (false);
+    return TRACE_RETURN (process (c));
   }
 
+  static bool apply_recurse_func (hb_apply_context_t *c, unsigned int lookup_index);
+
   inline bool apply_string (hb_apply_context_t *c, const hb_set_digest_t *digest) const
   {
     bool ret = false;
@@ -1538,6 +1482,7 @@ struct PosLookup : Lookup
     if (unlikely (!c->buffer->len || !c->lookup_mask))
       return false;
 
+    c->set_recurse_func (apply_recurse_func);
     c->set_lookup (*this);
 
     c->buffer->idx = 0;
@@ -1556,7 +1501,7 @@ struct PosLookup : Lookup
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (unlikely (!Lookup::sanitize (c))) return TRACE_RETURN (false);
     OffsetArrayOf<PosLookupSubTable> &list = CastR<OffsetArrayOf<PosLookupSubTable> > (subTable);
     return TRACE_RETURN (list.sanitize (c, this, get_type ()));
@@ -1576,15 +1521,11 @@ struct GPOS : GSUBGPOS
   inline const PosLookup& get_lookup (unsigned int i) const
   { return CastR<PosLookup> (GSUBGPOS::get_lookup (i)); }
 
-  template <typename set_t>
-  inline void add_coverage (set_t *glyphs, unsigned int lookup_index) const
-  { get_lookup (lookup_index).add_coverage (glyphs); }
-
   static inline void position_start (hb_font_t *font, hb_buffer_t *buffer);
   static inline void position_finish (hb_font_t *font, hb_buffer_t *buffer, hb_bool_t zero_width_attahced_marks);
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (unlikely (!GSUBGPOS::sanitize (c))) return TRACE_RETURN (false);
     OffsetTo<PosLookupList> &list = CastR<OffsetTo<PosLookupList> > (lookupList);
     return TRACE_RETURN (list.sanitize (c, this));
@@ -1673,38 +1614,25 @@ GPOS::position_finish (hb_font_t *font HB_UNUSED, hb_buffer_t *buffer, hb_bool_t
 
 /* Out-of-class implementation for methods recursing */
 
-inline const Coverage & ExtensionPos::get_coverage (void) const
-{
-  return get_subtable ().get_coverage (get_type ());
-}
-
-inline bool ExtensionPos::apply (hb_apply_context_t *c) const
-{
-  TRACE_APPLY ();
-  return TRACE_RETURN (get_subtable ().apply (c, get_type ()));
-}
-
-inline bool ExtensionPos::sanitize (hb_sanitize_context_t *c)
-{
-  TRACE_SANITIZE ();
-  if (unlikely (!Extension::sanitize (c))) return TRACE_RETURN (false);
-  unsigned int offset = get_offset ();
-  if (unlikely (!offset)) return TRACE_RETURN (true);
-  return TRACE_RETURN (StructAtOffset<PosLookupSubTable> (this, offset).sanitize (c, get_type ()));
-}
-
-static inline bool position_lookup (hb_apply_context_t *c, unsigned int lookup_index)
+template <typename context_t>
+inline typename context_t::return_t PosLookup::process_recurse_func (context_t *c, unsigned int lookup_index)
 {
   const GPOS &gpos = *(hb_ot_layout_from_face (c->face)->gpos);
   const PosLookup &l = gpos.get_lookup (lookup_index);
+  return l.process (c);
+}
 
-  if (unlikely (c->nesting_level_left == 0))
-    return false;
-
-  hb_apply_context_t new_c (*c);
-  new_c.nesting_level_left--;
-  new_c.set_lookup (l);
-  return l.apply_once (&new_c);
+inline bool PosLookup::apply_recurse_func (hb_apply_context_t *c, unsigned int lookup_index)
+{
+  const GPOS &gpos = *(hb_ot_layout_from_face (c->face)->gpos);
+  const PosLookup &l = gpos.get_lookup (lookup_index);
+  unsigned int saved_lookup_props = c->lookup_props;
+  unsigned int saved_property = c->property;
+  c->set_lookup (l);
+  bool ret = l.apply_once (c);
+  c->lookup_props = saved_lookup_props;
+  c->property = saved_property;
+  return ret;
 }
 
 
@@ -1712,7 +1640,7 @@ static inline bool position_lookup (hb_apply_context_t *c, unsigned int lookup_i
 #undef cursive_chain
 
 
-} // namespace OT
+} /* namespace OT */
 
 
 #endif /* HB_OT_LAYOUT_GPOS_TABLE_HH */
diff --git a/gfx/harfbuzz/src/hb-ot-layout-gsub-table.hh b/gfx/harfbuzz/src/hb-ot-layout-gsub-table.hh
index 05b18cc3ea6e..2642acbbb5ca 100644
--- a/gfx/harfbuzz/src/hb-ot-layout-gsub-table.hh
+++ b/gfx/harfbuzz/src/hb-ot-layout-gsub-table.hh
@@ -37,13 +37,9 @@ namespace OT {
 
 struct SingleSubstFormat1
 {
-  friend struct SingleSubst;
-
-  private:
-
   inline void closure (hb_closure_context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     Coverage::Iter iter;
     for (iter.init (this+coverage); iter.more (); iter.next ()) {
       hb_codepoint_t glyph_id = iter.get_glyph ();
@@ -52,16 +48,33 @@ struct SingleSubstFormat1
     }
   }
 
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    Coverage::Iter iter;
+    for (iter.init (this+coverage); iter.more (); iter.next ()) {
+      hb_codepoint_t glyph_id = iter.get_glyph ();
+      c->input->add (glyph_id);
+      c->output->add ((glyph_id + deltaGlyphID) & 0xFFFF);
+    }
+  }
+
   inline const Coverage &get_coverage (void) const
   {
     return this+coverage;
   }
 
+  inline bool would_apply (hb_would_apply_context_t *c) const
+  {
+    TRACE_WOULD_APPLY (this);
+    return TRACE_RETURN (c->len == 1 && (this+coverage).get_coverage (c->glyphs[0]) != NOT_COVERED);
+  }
+
   inline bool apply (hb_apply_context_t *c) const
   {
-    TRACE_APPLY ();
+    TRACE_APPLY (this);
     hb_codepoint_t glyph_id = c->buffer->cur().codepoint;
-    unsigned int index = (this+coverage) (glyph_id);
+    unsigned int index = (this+coverage).get_coverage (glyph_id);
     if (likely (index == NOT_COVERED)) return TRACE_RETURN (false);
 
     /* According to the Adobe Annotated OpenType Suite, result is always
@@ -77,7 +90,7 @@ struct SingleSubstFormat1
 			 unsigned int num_glyphs,
 			 int delta)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (*this))) return TRACE_RETURN (false);
     if (unlikely (!coverage.serialize (c, this).serialize (c, glyphs, num_glyphs))) return TRACE_RETURN (false);
     deltaGlyphID.set (delta); /* TODO(serilaize) overflow? */
@@ -85,7 +98,7 @@ struct SingleSubstFormat1
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (coverage.sanitize (c, this) && deltaGlyphID.sanitize (c));
   }
 
@@ -102,13 +115,9 @@ struct SingleSubstFormat1
 
 struct SingleSubstFormat2
 {
-  friend struct SingleSubst;
-
-  private:
-
   inline void closure (hb_closure_context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     Coverage::Iter iter;
     for (iter.init (this+coverage); iter.more (); iter.next ()) {
       if (c->glyphs->has (iter.get_glyph ()))
@@ -116,16 +125,32 @@ struct SingleSubstFormat2
     }
   }
 
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    Coverage::Iter iter;
+    for (iter.init (this+coverage); iter.more (); iter.next ()) {
+      c->input->add (iter.get_glyph ());
+      c->output->add (substitute[iter.get_coverage ()]);
+    }
+  }
+
   inline const Coverage &get_coverage (void) const
   {
     return this+coverage;
   }
 
+  inline bool would_apply (hb_would_apply_context_t *c) const
+  {
+    TRACE_WOULD_APPLY (this);
+    return TRACE_RETURN (c->len == 1 && (this+coverage).get_coverage (c->glyphs[0]) != NOT_COVERED);
+  }
+
   inline bool apply (hb_apply_context_t *c) const
   {
-    TRACE_APPLY ();
+    TRACE_APPLY (this);
     hb_codepoint_t glyph_id = c->buffer->cur().codepoint;
-    unsigned int index = (this+coverage) (glyph_id);
+    unsigned int index = (this+coverage).get_coverage (glyph_id);
     if (likely (index == NOT_COVERED)) return TRACE_RETURN (false);
 
     if (unlikely (index >= substitute.len)) return TRACE_RETURN (false);
@@ -141,7 +166,7 @@ struct SingleSubstFormat2
 			 Supplier<GlyphID> &substitutes,
 			 unsigned int num_glyphs)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (*this))) return TRACE_RETURN (false);
     if (unlikely (!substitute.serialize (c, substitutes, num_glyphs))) return TRACE_RETURN (false);
     if (unlikely (!coverage.serialize (c, this).serialize (c, glyphs, num_glyphs))) return TRACE_RETURN (false);
@@ -149,7 +174,7 @@ struct SingleSubstFormat2
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (coverage.sanitize (c, this) && substitute.sanitize (c));
   }
 
@@ -167,37 +192,14 @@ struct SingleSubstFormat2
 
 struct SingleSubst
 {
-  friend struct SubstLookupSubTable;
-  friend struct SubstLookup;
-
-  private:
-
-  inline void closure (hb_closure_context_t *c) const
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_PROCESS (this);
     switch (u.format) {
-    case 1: u.format1.closure (c); break;
-    case 2: u.format2.closure (c); break;
-    default:                       break;
-    }
-  }
-
-  inline const Coverage &get_coverage (void) const
-  {
-    switch (u.format) {
-    case 1: return u.format1.get_coverage ();
-    case 2: return u.format2.get_coverage ();
-    default:return Null(Coverage);
-    }
-  }
-
-  inline bool apply (hb_apply_context_t *c) const
-  {
-    TRACE_APPLY ();
-    switch (u.format) {
-    case 1: return TRACE_RETURN (u.format1.apply (c));
-    case 2: return TRACE_RETURN (u.format2.apply (c));
-    default:return TRACE_RETURN (false);
+    case 1: return TRACE_RETURN (c->process (u.format1));
+    case 2: return TRACE_RETURN (c->process (u.format2));
+    default:return TRACE_RETURN (c->default_return_value ());
     }
   }
 
@@ -206,7 +208,7 @@ struct SingleSubst
 			 Supplier<GlyphID> &substitutes,
 			 unsigned int num_glyphs)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (u.format))) return TRACE_RETURN (false);
     unsigned int format = 2;
     int delta;
@@ -229,7 +231,7 @@ struct SingleSubst
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -249,24 +251,28 @@ struct SingleSubst
 
 struct Sequence
 {
-  friend struct MultipleSubstFormat1;
-
-  private:
-
   inline void closure (hb_closure_context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     unsigned int count = substitute.len;
     for (unsigned int i = 0; i < count; i++)
       c->glyphs->add (substitute[i]);
   }
 
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    unsigned int count = substitute.len;
+    for (unsigned int i = 0; i < count; i++)
+      c->output->add (substitute[i]);
+  }
+
   inline bool apply (hb_apply_context_t *c) const
   {
-    TRACE_APPLY ();
+    TRACE_APPLY (this);
     if (unlikely (!substitute.len)) return TRACE_RETURN (false);
 
-    unsigned int klass = c->property & HB_OT_LAYOUT_GLYPH_CLASS_LIGATURE ? HB_OT_LAYOUT_GLYPH_CLASS_BASE_GLYPH : 0;
+    unsigned int klass = c->property & HB_OT_LAYOUT_GLYPH_PROPS_LIGATURE ? HB_OT_LAYOUT_GLYPH_PROPS_BASE_GLYPH : 0;
     unsigned int count = substitute.len;
     for (unsigned int i = 0; i < count; i++) {
       set_lig_props_for_component (c->buffer->cur(), i);
@@ -281,15 +287,14 @@ struct Sequence
 			 Supplier<GlyphID> &glyphs,
 			 unsigned int num_glyphs)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (*this))) return TRACE_RETURN (false);
     if (unlikely (!substitute.serialize (c, glyphs, num_glyphs))) return TRACE_RETURN (false);
     return TRACE_RETURN (true);
   }
 
-  public:
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (substitute.sanitize (c));
   }
 
@@ -302,13 +307,9 @@ struct Sequence
 
 struct MultipleSubstFormat1
 {
-  friend struct MultipleSubst;
-
-  private:
-
   inline void closure (hb_closure_context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     Coverage::Iter iter;
     for (iter.init (this+coverage); iter.more (); iter.next ()) {
       if (c->glyphs->has (iter.get_glyph ()))
@@ -316,16 +317,31 @@ struct MultipleSubstFormat1
     }
   }
 
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    (this+coverage).add_coverage (c->input);
+    unsigned int count = sequence.len;
+    for (unsigned int i = 0; i < count; i++)
+	(this+sequence[i]).collect_glyphs (c);
+  }
+
   inline const Coverage &get_coverage (void) const
   {
     return this+coverage;
   }
 
+  inline bool would_apply (hb_would_apply_context_t *c) const
+  {
+    TRACE_WOULD_APPLY (this);
+    return TRACE_RETURN (c->len == 1 && (this+coverage).get_coverage (c->glyphs[0]) != NOT_COVERED);
+  }
+
   inline bool apply (hb_apply_context_t *c) const
   {
-    TRACE_APPLY ();
+    TRACE_APPLY (this);
 
-    unsigned int index = (this+coverage) (c->buffer->cur().codepoint);
+    unsigned int index = (this+coverage).get_coverage (c->buffer->cur().codepoint);
     if (likely (index == NOT_COVERED)) return TRACE_RETURN (false);
 
     return TRACE_RETURN ((this+sequence[index]).apply (c));
@@ -337,7 +353,7 @@ struct MultipleSubstFormat1
 			 unsigned int num_glyphs,
 			 Supplier<GlyphID> &substitute_glyphs_list)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (*this))) return TRACE_RETURN (false);
     if (unlikely (!sequence.serialize (c, num_glyphs))) return TRACE_RETURN (false);
     for (unsigned int i = 0; i < num_glyphs; i++)
@@ -350,7 +366,7 @@ struct MultipleSubstFormat1
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (coverage.sanitize (c, this) && sequence.sanitize (c, this));
   }
 
@@ -368,34 +384,13 @@ struct MultipleSubstFormat1
 
 struct MultipleSubst
 {
-  friend struct SubstLookupSubTable;
-  friend struct SubstLookup;
-
-  private:
-
-  inline void closure (hb_closure_context_t *c) const
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_PROCESS (this);
     switch (u.format) {
-    case 1: u.format1.closure (c); break;
-    default:                       break;
-    }
-  }
-
-  inline const Coverage &get_coverage (void) const
-  {
-    switch (u.format) {
-    case 1: return u.format1.get_coverage ();
-    default:return Null(Coverage);
-    }
-  }
-
-  inline bool apply (hb_apply_context_t *c) const
-  {
-    TRACE_APPLY ();
-    switch (u.format) {
-    case 1: return TRACE_RETURN (u.format1.apply (c));
-    default:return TRACE_RETURN (false);
+    case 1: return TRACE_RETURN (c->process (u.format1));
+    default:return TRACE_RETURN (c->default_return_value ());
     }
   }
 
@@ -405,7 +400,7 @@ struct MultipleSubst
 			 unsigned int num_glyphs,
 			 Supplier<GlyphID> &substitute_glyphs_list)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (u.format))) return TRACE_RETURN (false);
     unsigned int format = 1;
     u.format.set (format);
@@ -416,7 +411,7 @@ struct MultipleSubst
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -437,13 +432,9 @@ typedef ArrayOf<GlyphID> AlternateSet;	/* Array of alternate GlyphIDs--in
 
 struct AlternateSubstFormat1
 {
-  friend struct AlternateSubst;
-
-  private:
-
   inline void closure (hb_closure_context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     Coverage::Iter iter;
     for (iter.init (this+coverage); iter.more (); iter.next ()) {
       if (c->glyphs->has (iter.get_glyph ())) {
@@ -455,17 +446,36 @@ struct AlternateSubstFormat1
     }
   }
 
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    Coverage::Iter iter;
+    for (iter.init (this+coverage); iter.more (); iter.next ()) {
+      c->input->add (iter.get_glyph ());
+      const AlternateSet &alt_set = this+alternateSet[iter.get_coverage ()];
+      unsigned int count = alt_set.len;
+      for (unsigned int i = 0; i < count; i++)
+	c->output->add (alt_set[i]);
+    }
+  }
+
   inline const Coverage &get_coverage (void) const
   {
     return this+coverage;
   }
 
+  inline bool would_apply (hb_would_apply_context_t *c) const
+  {
+    TRACE_WOULD_APPLY (this);
+    return TRACE_RETURN (c->len == 1 && (this+coverage).get_coverage (c->glyphs[0]) != NOT_COVERED);
+  }
+
   inline bool apply (hb_apply_context_t *c) const
   {
-    TRACE_APPLY ();
+    TRACE_APPLY (this);
     hb_codepoint_t glyph_id = c->buffer->cur().codepoint;
 
-    unsigned int index = (this+coverage) (glyph_id);
+    unsigned int index = (this+coverage).get_coverage (glyph_id);
     if (likely (index == NOT_COVERED)) return TRACE_RETURN (false);
 
     const AlternateSet &alt_set = this+alternateSet[index];
@@ -494,7 +504,7 @@ struct AlternateSubstFormat1
 			 unsigned int num_glyphs,
 			 Supplier<GlyphID> &alternate_glyphs_list)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (*this))) return TRACE_RETURN (false);
     if (unlikely (!alternateSet.serialize (c, num_glyphs))) return TRACE_RETURN (false);
     for (unsigned int i = 0; i < num_glyphs; i++)
@@ -507,7 +517,7 @@ struct AlternateSubstFormat1
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (coverage.sanitize (c, this) && alternateSet.sanitize (c, this));
   }
 
@@ -525,34 +535,13 @@ struct AlternateSubstFormat1
 
 struct AlternateSubst
 {
-  friend struct SubstLookupSubTable;
-  friend struct SubstLookup;
-
-  private:
-
-  inline void closure (hb_closure_context_t *c) const
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_PROCESS (this);
     switch (u.format) {
-    case 1: u.format1.closure (c); break;
-    default:                       break;
-    }
-  }
-
-  inline const Coverage &get_coverage (void) const
-  {
-    switch (u.format) {
-    case 1: return u.format1.get_coverage ();
-    default:return Null(Coverage);
-    }
-  }
-
-  inline bool apply (hb_apply_context_t *c) const
-  {
-    TRACE_APPLY ();
-    switch (u.format) {
-    case 1: return TRACE_RETURN (u.format1.apply (c));
-    default:return TRACE_RETURN (false);
+    case 1: return TRACE_RETURN (c->process (u.format1));
+    default:return TRACE_RETURN (c->default_return_value ());
     }
   }
 
@@ -562,7 +551,7 @@ struct AlternateSubst
 			 unsigned int num_glyphs,
 			 Supplier<GlyphID> &alternate_glyphs_list)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (u.format))) return TRACE_RETURN (false);
     unsigned int format = 1;
     u.format.set (format);
@@ -573,7 +562,7 @@ struct AlternateSubst
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -591,13 +580,9 @@ struct AlternateSubst
 
 struct Ligature
 {
-  friend struct LigatureSet;
-
-  private:
-
   inline void closure (hb_closure_context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     unsigned int count = component.len;
     for (unsigned int i = 1; i < count; i++)
       if (!c->glyphs->has (component[i]))
@@ -605,27 +590,37 @@ struct Ligature
     c->glyphs->add (ligGlyph);
   }
 
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    unsigned int count = component.len;
+    for (unsigned int i = 1; i < count; i++)
+      c->input->add (component[i]);
+    c->output->add (ligGlyph);
+  }
+
   inline bool would_apply (hb_would_apply_context_t *c) const
   {
+    TRACE_WOULD_APPLY (this);
     if (c->len != component.len)
-      return false;
+      return TRACE_RETURN (false);
 
     for (unsigned int i = 1; i < c->len; i++)
       if (likely (c->glyphs[i] != component[i]))
-	return false;
+	return TRACE_RETURN (false);
 
-    return true;
+    return TRACE_RETURN (true);
   }
 
   inline bool apply (hb_apply_context_t *c) const
   {
-    TRACE_APPLY ();
+    TRACE_APPLY (this);
     unsigned int count = component.len;
     if (unlikely (count < 1)) return TRACE_RETURN (false);
 
-    unsigned int end_offset;
-    bool is_mark_ligature;
-    unsigned int total_component_count;
+    unsigned int end_offset = 0;
+    bool is_mark_ligature = false;
+    unsigned int total_component_count = 0;
 
     if (likely (!match_input (c, count,
 			      &component[1],
@@ -656,7 +651,7 @@ struct Ligature
 			 Supplier<GlyphID> &components, /* Starting from second */
 			 unsigned int num_components /* Including first component */)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (*this))) return TRACE_RETURN (false);
     ligGlyph = ligature;
     if (unlikely (!component.serialize (c, components, num_components))) return TRACE_RETURN (false);
@@ -665,7 +660,7 @@ struct Ligature
 
   public:
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (ligGlyph.sanitize (c) && component.sanitize (c));
   }
 
@@ -681,33 +676,38 @@ struct Ligature
 
 struct LigatureSet
 {
-  friend struct LigatureSubstFormat1;
-
-  private:
-
   inline void closure (hb_closure_context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     unsigned int num_ligs = ligature.len;
     for (unsigned int i = 0; i < num_ligs; i++)
       (this+ligature[i]).closure (c);
   }
 
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    unsigned int num_ligs = ligature.len;
+    for (unsigned int i = 0; i < num_ligs; i++)
+      (this+ligature[i]).collect_glyphs (c);
+  }
+
   inline bool would_apply (hb_would_apply_context_t *c) const
   {
+    TRACE_WOULD_APPLY (this);
     unsigned int num_ligs = ligature.len;
     for (unsigned int i = 0; i < num_ligs; i++)
     {
       const Ligature &lig = this+ligature[i];
       if (lig.would_apply (c))
-        return true;
+        return TRACE_RETURN (true);
     }
-    return false;
+    return TRACE_RETURN (false);
   }
 
   inline bool apply (hb_apply_context_t *c) const
   {
-    TRACE_APPLY ();
+    TRACE_APPLY (this);
     unsigned int num_ligs = ligature.len;
     for (unsigned int i = 0; i < num_ligs; i++)
     {
@@ -724,7 +724,7 @@ struct LigatureSet
 			 unsigned int num_ligatures,
 			 Supplier<GlyphID> &component_list /* Starting from second for each ligature */)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (*this))) return TRACE_RETURN (false);
     if (unlikely (!ligature.serialize (c, num_ligatures))) return TRACE_RETURN (false);
     for (unsigned int i = 0; i < num_ligatures; i++)
@@ -737,9 +737,8 @@ struct LigatureSet
     return TRACE_RETURN (true);
   }
 
-  public:
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (ligature.sanitize (c, this));
   }
 
@@ -753,13 +752,9 @@ struct LigatureSet
 
 struct LigatureSubstFormat1
 {
-  friend struct LigatureSubst;
-
-  private:
-
   inline void closure (hb_closure_context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     Coverage::Iter iter;
     for (iter.init (this+coverage); iter.more (); iter.next ()) {
       if (c->glyphs->has (iter.get_glyph ()))
@@ -767,6 +762,16 @@ struct LigatureSubstFormat1
     }
   }
 
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    Coverage::Iter iter;
+    for (iter.init (this+coverage); iter.more (); iter.next ()) {
+      c->input->add (iter.get_glyph ());
+      (this+ligatureSet[iter.get_coverage ()]).collect_glyphs (c);
+    }
+  }
+
   inline const Coverage &get_coverage (void) const
   {
     return this+coverage;
@@ -774,15 +779,20 @@ struct LigatureSubstFormat1
 
   inline bool would_apply (hb_would_apply_context_t *c) const
   {
-    return (this+ligatureSet[(this+coverage) (c->glyphs[0])]).would_apply (c);
+    TRACE_WOULD_APPLY (this);
+    unsigned int index = (this+coverage).get_coverage (c->glyphs[0]);
+    if (likely (index == NOT_COVERED)) return TRACE_RETURN (false);
+
+    const LigatureSet &lig_set = this+ligatureSet[index];
+    return TRACE_RETURN (lig_set.would_apply (c));
   }
 
   inline bool apply (hb_apply_context_t *c) const
   {
-    TRACE_APPLY ();
+    TRACE_APPLY (this);
     hb_codepoint_t glyph_id = c->buffer->cur().codepoint;
 
-    unsigned int index = (this+coverage) (glyph_id);
+    unsigned int index = (this+coverage).get_coverage (glyph_id);
     if (likely (index == NOT_COVERED)) return TRACE_RETURN (false);
 
     const LigatureSet &lig_set = this+ligatureSet[index];
@@ -797,7 +807,7 @@ struct LigatureSubstFormat1
 			 Supplier<unsigned int> &component_count_list,
 			 Supplier<GlyphID> &component_list /* Starting from second for each ligature */)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (*this))) return TRACE_RETURN (false);
     if (unlikely (!ligatureSet.serialize (c, num_first_glyphs))) return TRACE_RETURN (false);
     for (unsigned int i = 0; i < num_first_glyphs; i++)
@@ -812,7 +822,7 @@ struct LigatureSubstFormat1
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (coverage.sanitize (c, this) && ligatureSet.sanitize (c, this));
   }
 
@@ -830,42 +840,13 @@ struct LigatureSubstFormat1
 
 struct LigatureSubst
 {
-  friend struct SubstLookupSubTable;
-  friend struct SubstLookup;
-
-  private:
-
-  inline void closure (hb_closure_context_t *c) const
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_PROCESS (this);
     switch (u.format) {
-    case 1: u.format1.closure (c); break;
-    default:                       break;
-    }
-  }
-
-  inline const Coverage &get_coverage (void) const
-  {
-    switch (u.format) {
-    case 1: return u.format1.get_coverage ();
-    default:return Null(Coverage);
-    }
-  }
-
-  inline bool would_apply (hb_would_apply_context_t *c) const
-  {
-    switch (u.format) {
-    case 1: return u.format1.would_apply (c);
-    default:return false;
-    }
-  }
-
-  inline bool apply (hb_apply_context_t *c) const
-  {
-    TRACE_APPLY ();
-    switch (u.format) {
-    case 1: return TRACE_RETURN (u.format1.apply (c));
-    default:return TRACE_RETURN (false);
+    case 1: return TRACE_RETURN (c->process (u.format1));
+    default:return TRACE_RETURN (c->default_return_value ());
     }
   }
 
@@ -877,7 +858,7 @@ struct LigatureSubst
 			 Supplier<unsigned int> &component_count_list,
 			 Supplier<GlyphID> &component_list /* Starting from second for each ligature */)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!c->extend_min (u.format))) return TRACE_RETURN (false);
     unsigned int format = 1;
     u.format.set (format);
@@ -889,7 +870,7 @@ struct LigatureSubst
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -905,70 +886,13 @@ struct LigatureSubst
 };
 
 
-static inline bool substitute_lookup (hb_apply_context_t *c, unsigned int lookup_index);
-static inline void closure_lookup (hb_closure_context_t *c, unsigned int lookup_index);
+struct ContextSubst : Context {};
 
-struct ContextSubst : Context
+struct ChainContextSubst : ChainContext {};
+
+struct ExtensionSubst : Extension<ExtensionSubst>
 {
-  friend struct SubstLookupSubTable;
-
-  private:
-
-  inline void closure (hb_closure_context_t *c) const
-  {
-    TRACE_CLOSURE ();
-    return Context::closure (c, closure_lookup);
-  }
-
-  inline bool apply (hb_apply_context_t *c) const
-  {
-    TRACE_APPLY ();
-    return TRACE_RETURN (Context::apply (c, substitute_lookup));
-  }
-};
-
-struct ChainContextSubst : ChainContext
-{
-  friend struct SubstLookupSubTable;
-
-  private:
-
-  inline void closure (hb_closure_context_t *c) const
-  {
-    TRACE_CLOSURE ();
-    return ChainContext::closure (c, closure_lookup);
-  }
-
-  inline bool apply (hb_apply_context_t *c) const
-  {
-    TRACE_APPLY ();
-    return TRACE_RETURN (ChainContext::apply (c, substitute_lookup));
-  }
-};
-
-
-struct ExtensionSubst : Extension
-{
-  friend struct SubstLookupSubTable;
-  friend struct SubstLookup;
-
-  private:
-  inline const struct SubstLookupSubTable& get_subtable (void) const
-  {
-    unsigned int offset = get_offset ();
-    if (unlikely (!offset)) return Null(SubstLookupSubTable);
-    return StructAtOffset<SubstLookupSubTable> (this, offset);
-  }
-
-  inline void closure (hb_closure_context_t *c) const;
-
-  inline const Coverage &get_coverage (void) const;
-
-  inline bool would_apply (hb_would_apply_context_t *c) const;
-
-  inline bool apply (hb_apply_context_t *c) const;
-
-  inline bool sanitize (hb_sanitize_context_t *c);
+  typedef struct SubstLookupSubTable LookupSubTable;
 
   inline bool is_reverse (void) const;
 };
@@ -976,13 +900,9 @@ struct ExtensionSubst : Extension
 
 struct ReverseChainSingleSubstFormat1
 {
-  friend struct ReverseChainSingleSubst;
-
-  private:
-
   inline void closure (hb_closure_context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     const OffsetArrayOf<Coverage> &lookahead = StructAfter<OffsetArrayOf<Coverage> > (backtrack);
 
     unsigned int count;
@@ -1005,18 +925,48 @@ struct ReverseChainSingleSubstFormat1
     }
   }
 
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+
+    const OffsetArrayOf<Coverage> &lookahead = StructAfter<OffsetArrayOf<Coverage> > (backtrack);
+
+    unsigned int count;
+
+    (this+coverage).add_coverage (c->input);
+
+    count = backtrack.len;
+    for (unsigned int i = 0; i < count; i++)
+      (this+backtrack[i]).add_coverage (c->before);
+
+    count = lookahead.len;
+    for (unsigned int i = 0; i < count; i++)
+      (this+lookahead[i]).add_coverage (c->after);
+
+    const ArrayOf<GlyphID> &substitute = StructAfter<ArrayOf<GlyphID> > (lookahead);
+    count = substitute.len;
+    for (unsigned int i = 0; i < count; i++)
+      c->output->add (substitute[i]);
+  }
+
   inline const Coverage &get_coverage (void) const
   {
     return this+coverage;
   }
 
+  inline bool would_apply (hb_would_apply_context_t *c) const
+  {
+    TRACE_WOULD_APPLY (this);
+    return TRACE_RETURN (c->len == 1 && (this+coverage).get_coverage (c->glyphs[0]) != NOT_COVERED);
+  }
+
   inline bool apply (hb_apply_context_t *c) const
   {
-    TRACE_APPLY ();
+    TRACE_APPLY (this);
     if (unlikely (c->nesting_level_left != MAX_NESTING_LEVEL))
       return TRACE_RETURN (false); /* No chaining to this type */
 
-    unsigned int index = (this+coverage) (c->buffer->cur().codepoint);
+    unsigned int index = (this+coverage).get_coverage (c->buffer->cur().codepoint);
     if (likely (index == NOT_COVERED)) return TRACE_RETURN (false);
 
     const OffsetArrayOf<Coverage> &lookahead = StructAfter<OffsetArrayOf<Coverage> > (backtrack);
@@ -1039,7 +989,7 @@ struct ReverseChainSingleSubstFormat1
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!(coverage.sanitize (c, this) && backtrack.sanitize (c, this)))
       return TRACE_RETURN (false);
     OffsetArrayOf<Coverage> &lookahead = StructAfter<OffsetArrayOf<Coverage> > (backtrack);
@@ -1071,38 +1021,18 @@ struct ReverseChainSingleSubstFormat1
 
 struct ReverseChainSingleSubst
 {
-  friend struct SubstLookupSubTable;
-
-  private:
-
-  inline void closure (hb_closure_context_t *c) const
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_PROCESS (this);
     switch (u.format) {
-    case 1: u.format1.closure (c); break;
-    default:                       break;
-    }
-  }
-
-  inline const Coverage &get_coverage (void) const
-  {
-    switch (u.format) {
-    case 1: return u.format1.get_coverage ();
-    default:return Null(Coverage);
-    }
-  }
-
-  inline bool apply (hb_apply_context_t *c) const
-  {
-    TRACE_APPLY ();
-    switch (u.format) {
-    case 1: return TRACE_RETURN (u.format1.apply (c));
-    default:return TRACE_RETURN (false);
+    case 1: return TRACE_RETURN (c->process (u.format1));
+    default:return TRACE_RETURN (c->default_return_value ());
     }
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -1138,82 +1068,25 @@ struct SubstLookupSubTable
     ReverseChainSingle	= 8
   };
 
-  inline void closure (hb_closure_context_t *c,
-		       unsigned int    lookup_type) const
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c, unsigned int lookup_type) const
   {
-    TRACE_CLOSURE ();
+    TRACE_PROCESS (this);
     switch (lookup_type) {
-    case Single:		u.single.closure (c); break;
-    case Multiple:		u.multiple.closure (c); break;
-    case Alternate:		u.alternate.closure (c); break;
-    case Ligature:		u.ligature.closure (c); break;
-    case Context:		u.context.closure (c); break;
-    case ChainContext:		u.chainContext.closure (c); break;
-    case Extension:		u.extension.closure (c); break;
-    case ReverseChainSingle:	u.reverseChainContextSingle.closure (c); break;
-    default:                    break;
-    }
-  }
-
-  inline const Coverage &get_coverage (unsigned int lookup_type) const
-  {
-    switch (lookup_type) {
-    case Single:		return u.single.get_coverage ();
-    case Multiple:		return u.multiple.get_coverage ();
-    case Alternate:		return u.alternate.get_coverage ();
-    case Ligature:		return u.ligature.get_coverage ();
-    case Context:		return u.context.get_coverage ();
-    case ChainContext:		return u.chainContext.get_coverage ();
-    case Extension:		return u.extension.get_coverage ();
-    case ReverseChainSingle:	return u.reverseChainContextSingle.get_coverage ();
-    default:			return Null(Coverage);
-    }
-  }
-
-  inline bool would_apply (hb_would_apply_context_t *c,
-			   unsigned int lookup_type) const
-  {
-    TRACE_WOULD_APPLY ();
-    if (get_coverage (lookup_type).get_coverage (c->glyphs[0]) == NOT_COVERED) return false;
-    if (c->len == 1) {
-      switch (lookup_type) {
-      case Single:
-      case Multiple:
-      case Alternate:
-      case ReverseChainSingle:
-        return true;
-      }
-    }
-
-    /* Only need to look further for lookups that support substitutions
-     * of input longer than 1. */
-    switch (lookup_type) {
-    case Ligature:		return u.ligature.would_apply (c);
-    case Context:		return u.context.would_apply (c);
-    case ChainContext:		return u.chainContext.would_apply (c);
-    case Extension:		return u.extension.would_apply (c);
-    default:			return false;
-    }
-  }
-
-  inline bool apply (hb_apply_context_t *c, unsigned int lookup_type) const
-  {
-    TRACE_APPLY ();
-    switch (lookup_type) {
-    case Single:		return TRACE_RETURN (u.single.apply (c));
-    case Multiple:		return TRACE_RETURN (u.multiple.apply (c));
-    case Alternate:		return TRACE_RETURN (u.alternate.apply (c));
-    case Ligature:		return TRACE_RETURN (u.ligature.apply (c));
-    case Context:		return TRACE_RETURN (u.context.apply (c));
-    case ChainContext:		return TRACE_RETURN (u.chainContext.apply (c));
-    case Extension:		return TRACE_RETURN (u.extension.apply (c));
-    case ReverseChainSingle:	return TRACE_RETURN (u.reverseChainContextSingle.apply (c));
-    default:			return TRACE_RETURN (false);
+    case Single:		return TRACE_RETURN (u.single.process (c));
+    case Multiple:		return TRACE_RETURN (u.multiple.process (c));
+    case Alternate:		return TRACE_RETURN (u.alternate.process (c));
+    case Ligature:		return TRACE_RETURN (u.ligature.process (c));
+    case Context:		return TRACE_RETURN (u.context.process (c));
+    case ChainContext:		return TRACE_RETURN (u.chainContext.process (c));
+    case Extension:		return TRACE_RETURN (u.extension.process (c));
+    case ReverseChainSingle:	return TRACE_RETURN (u.reverseChainContextSingle.process (c));
+    default:			return TRACE_RETURN (c->default_return_value ());
     }
   }
 
   inline bool sanitize (hb_sanitize_context_t *c, unsigned int lookup_type) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.header.sub_format.sanitize (c))
       return TRACE_RETURN (false);
     switch (lookup_type) {
@@ -1264,55 +1137,68 @@ struct SubstLookup : Lookup
     return lookup_type_is_reverse (type);
   }
 
-  inline void closure (hb_closure_context_t *c) const
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c) const
   {
+    TRACE_PROCESS (this);
     unsigned int lookup_type = get_type ();
     unsigned int count = get_subtable_count ();
-    for (unsigned int i = 0; i < count; i++)
-      get_subtable (i).closure (c, lookup_type);
+    for (unsigned int i = 0; i < count; i++) {
+      typename context_t::return_t r = get_subtable (i).process (c, lookup_type);
+      if (c->stop_sublookup_iteration (r))
+        return TRACE_RETURN (r);
+    }
+    return TRACE_RETURN (c->default_return_value ());
+  }
+  template <typename context_t>
+  static inline typename context_t::return_t process_recurse_func (context_t *c, unsigned int lookup_index);
+
+  inline hb_closure_context_t::return_t closure (hb_closure_context_t *c) const
+  {
+    TRACE_CLOSURE (this);
+    c->set_recurse_func (process_recurse_func<hb_closure_context_t>);
+    return TRACE_RETURN (process (c));
+  }
+
+  inline hb_collect_glyphs_context_t::return_t collect_glyphs_lookup (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    c->set_recurse_func (process_recurse_func<hb_collect_glyphs_context_t>);
+    return TRACE_RETURN (process (c));
   }
 
   template <typename set_t>
   inline void add_coverage (set_t *glyphs) const
   {
+    hb_get_coverage_context_t c;
     const Coverage *last = NULL;
     unsigned int count = get_subtable_count ();
     for (unsigned int i = 0; i < count; i++) {
-      const Coverage *c = &get_subtable (i).get_coverage (get_type ());
-      if (c != last) {
-        c->add_coverage (glyphs);
-        last = c;
+      const Coverage *coverage = &get_subtable (i).process (&c, get_type ());
+      if (coverage != last) {
+        coverage->add_coverage (glyphs);
+        last = coverage;
       }
     }
   }
 
   inline bool would_apply (hb_would_apply_context_t *c, const hb_set_digest_t *digest) const
   {
-    if (unlikely (!c->len)) return false;
-    if (!digest->may_have (c->glyphs[0])) return false;
-    unsigned int lookup_type = get_type ();
-    unsigned int count = get_subtable_count ();
-    for (unsigned int i = 0; i < count; i++)
-      if (get_subtable (i).would_apply (c, lookup_type))
-	return true;
-    return false;
+    TRACE_WOULD_APPLY (this);
+    if (unlikely (!c->len))  return TRACE_RETURN (false);
+    if (!digest->may_have (c->glyphs[0]))  return TRACE_RETURN (false);
+      return TRACE_RETURN (process (c));
   }
 
   inline bool apply_once (hb_apply_context_t *c) const
   {
-    unsigned int lookup_type = get_type ();
-
+    TRACE_APPLY (this);
     if (!c->check_glyph_property (&c->buffer->cur(), c->lookup_props, &c->property))
-      return false;
-
-    unsigned int count = get_subtable_count ();
-    for (unsigned int i = 0; i < count; i++)
-      if (get_subtable (i).apply (c, lookup_type))
-	return true;
-
-    return false;
+      return TRACE_RETURN (false);
+    return TRACE_RETURN (process (c));
   }
 
+  static bool apply_recurse_func (hb_apply_context_t *c, unsigned int lookup_index);
   inline bool apply_string (hb_apply_context_t *c, const hb_set_digest_t *digest) const
   {
     bool ret = false;
@@ -1320,6 +1206,7 @@ struct SubstLookup : Lookup
     if (unlikely (!c->buffer->len || !c->lookup_mask))
       return false;
 
+    c->set_recurse_func (apply_recurse_func);
     c->set_lookup (*this);
 
     if (likely (!is_reverse ()))
@@ -1361,11 +1248,9 @@ struct SubstLookup : Lookup
     return ret;
   }
 
-  private:
   inline SubstLookupSubTable& serialize_subtable (hb_serialize_context_t *c,
 						  unsigned int i)
   { return CastR<OffsetArrayOf<SubstLookupSubTable> > (subTable)[i].serialize (c, this); }
-  public:
 
   inline bool serialize_single (hb_serialize_context_t *c,
 				uint32_t lookup_props,
@@ -1373,7 +1258,7 @@ struct SubstLookup : Lookup
 			        Supplier<GlyphID> &substitutes,
 			        unsigned int num_glyphs)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!Lookup::serialize (c, SubstLookupSubTable::Single, lookup_props, 1))) return TRACE_RETURN (false);
     return TRACE_RETURN (serialize_subtable (c, 0).u.single.serialize (c, glyphs, substitutes, num_glyphs));
   }
@@ -1385,7 +1270,7 @@ struct SubstLookup : Lookup
 				  unsigned int num_glyphs,
 				  Supplier<GlyphID> &substitute_glyphs_list)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!Lookup::serialize (c, SubstLookupSubTable::Multiple, lookup_props, 1))) return TRACE_RETURN (false);
     return TRACE_RETURN (serialize_subtable (c, 0).u.multiple.serialize (c, glyphs, substitute_len_list, num_glyphs,
 									 substitute_glyphs_list));
@@ -1398,7 +1283,7 @@ struct SubstLookup : Lookup
 				   unsigned int num_glyphs,
 				   Supplier<GlyphID> &alternate_glyphs_list)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!Lookup::serialize (c, SubstLookupSubTable::Alternate, lookup_props, 1))) return TRACE_RETURN (false);
     return TRACE_RETURN (serialize_subtable (c, 0).u.alternate.serialize (c, glyphs, alternate_len_list, num_glyphs,
 									  alternate_glyphs_list));
@@ -1413,7 +1298,7 @@ struct SubstLookup : Lookup
 				  Supplier<unsigned int> &component_count_list,
 				  Supplier<GlyphID> &component_list /* Starting from second for each ligature */)
   {
-    TRACE_SERIALIZE ();
+    TRACE_SERIALIZE (this);
     if (unlikely (!Lookup::serialize (c, SubstLookupSubTable::Ligature, lookup_props, 1))) return TRACE_RETURN (false);
     return TRACE_RETURN (serialize_subtable (c, 0).u.ligature.serialize (c, first_glyphs, ligature_per_first_glyph_count_list, num_first_glyphs,
 									 ligatures_list, component_count_list, component_list));
@@ -1421,7 +1306,7 @@ struct SubstLookup : Lookup
 
   inline bool sanitize (hb_sanitize_context_t *c)
   {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (unlikely (!Lookup::sanitize (c))) return TRACE_RETURN (false);
     OffsetArrayOf<SubstLookupSubTable> &list = CastR<OffsetArrayOf<SubstLookupSubTable> > (subTable);
     if (unlikely (!list.sanitize (c, this, get_type ()))) return TRACE_RETURN (false);
@@ -1456,19 +1341,11 @@ struct GSUB : GSUBGPOS
   inline const SubstLookup& get_lookup (unsigned int i) const
   { return CastR<SubstLookup> (GSUBGPOS::get_lookup (i)); }
 
-  template <typename set_t>
-  inline void add_coverage (set_t *glyphs, unsigned int lookup_index) const
-  { get_lookup (lookup_index).add_coverage (glyphs); }
-
   static inline void substitute_start (hb_font_t *font, hb_buffer_t *buffer);
   static inline void substitute_finish (hb_font_t *font, hb_buffer_t *buffer);
 
-  inline void closure_lookup (hb_closure_context_t *c,
-			      unsigned int          lookup_index) const
-  { return get_lookup (lookup_index).closure (c); }
-
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (unlikely (!GSUBGPOS::sanitize (c))) return TRACE_RETURN (false);
     OffsetTo<SubstLookupList> &list = CastR<OffsetTo<SubstLookupList> > (lookupList);
     return TRACE_RETURN (list.sanitize (c, this));
@@ -1501,73 +1378,37 @@ GSUB::substitute_finish (hb_font_t *font HB_UNUSED, hb_buffer_t *buffer HB_UNUSE
 
 /* Out-of-class implementation for methods recursing */
 
-inline void ExtensionSubst::closure (hb_closure_context_t *c) const
-{
-  get_subtable ().closure (c, get_type ());
-}
-
-inline const Coverage & ExtensionSubst::get_coverage (void) const
-{
-  return get_subtable ().get_coverage (get_type ());
-}
-
-inline bool ExtensionSubst::would_apply (hb_would_apply_context_t *c) const
-{
-  return get_subtable ().would_apply (c, get_type ());
-}
-
-inline bool ExtensionSubst::apply (hb_apply_context_t *c) const
-{
-  TRACE_APPLY ();
-  return TRACE_RETURN (get_subtable ().apply (c, get_type ()));
-}
-
-inline bool ExtensionSubst::sanitize (hb_sanitize_context_t *c)
-{
-  TRACE_SANITIZE ();
-  if (unlikely (!Extension::sanitize (c))) return TRACE_RETURN (false);
-  unsigned int offset = get_offset ();
-  if (unlikely (!offset)) return TRACE_RETURN (true);
-  return TRACE_RETURN (StructAtOffset<SubstLookupSubTable> (this, offset).sanitize (c, get_type ()));
-}
-
 inline bool ExtensionSubst::is_reverse (void) const
 {
   unsigned int type = get_type ();
   if (unlikely (type == SubstLookupSubTable::Extension))
-    return CastR<ExtensionSubst> (get_subtable()).is_reverse ();
+    return CastR<ExtensionSubst> (get_subtable<SubstLookupSubTable>()).is_reverse ();
   return SubstLookup::lookup_type_is_reverse (type);
 }
 
-static inline void closure_lookup (hb_closure_context_t *c, unsigned int lookup_index)
+template <typename context_t>
+inline typename context_t::return_t SubstLookup::process_recurse_func (context_t *c, unsigned int lookup_index)
 {
   const GSUB &gsub = *(hb_ot_layout_from_face (c->face)->gsub);
   const SubstLookup &l = gsub.get_lookup (lookup_index);
-
-  if (unlikely (c->nesting_level_left == 0))
-    return;
-
-  c->nesting_level_left--;
-  l.closure (c);
-  c->nesting_level_left++;
+  return l.process (c);
 }
 
-static inline bool substitute_lookup (hb_apply_context_t *c, unsigned int lookup_index)
+inline bool SubstLookup::apply_recurse_func (hb_apply_context_t *c, unsigned int lookup_index)
 {
   const GSUB &gsub = *(hb_ot_layout_from_face (c->face)->gsub);
   const SubstLookup &l = gsub.get_lookup (lookup_index);
-
-  if (unlikely (c->nesting_level_left == 0))
-    return false;
-
-  hb_apply_context_t new_c (*c);
-  new_c.nesting_level_left--;
-  new_c.set_lookup (l);
-  return l.apply_once (&new_c);
+  unsigned int saved_lookup_props = c->lookup_props;
+  unsigned int saved_property = c->property;
+  c->set_lookup (l);
+  bool ret = l.apply_once (c);
+  c->lookup_props = saved_lookup_props;
+  c->property = saved_property;
+  return ret;
 }
 
 
-} // namespace OT
+} /* namespace OT */
 
 
 #endif /* HB_OT_LAYOUT_GSUB_TABLE_HH */
diff --git a/gfx/harfbuzz/src/hb-ot-layout-gsubgpos-private.hh b/gfx/harfbuzz/src/hb-ot-layout-gsubgpos-private.hh
index dd7bdd3aeabb..40be861f39c1 100644
--- a/gfx/harfbuzz/src/hb-ot-layout-gsubgpos-private.hh
+++ b/gfx/harfbuzz/src/hb-ot-layout-gsubgpos-private.hh
@@ -37,44 +37,82 @@
 namespace OT {
 
 
+
+#define TRACE_PROCESS(this) \
+	hb_auto_trace_t<context_t::max_debug_depth, typename context_t::return_t> trace \
+	(&c->debug_depth, c->get_name (), this, HB_FUNC, \
+	 "");
+
+
 #ifndef HB_DEBUG_CLOSURE
 #define HB_DEBUG_CLOSURE (HB_DEBUG+0)
 #endif
 
-#define TRACE_CLOSURE() \
-	hb_auto_trace_t<HB_DEBUG_CLOSURE> trace (&c->debug_depth, "CLOSURE", this, HB_FUNC, "");
-
+#define TRACE_CLOSURE(this) \
+	hb_auto_trace_t<HB_DEBUG_CLOSURE, hb_void_t> trace \
+	(&c->debug_depth, c->get_name (), this, HB_FUNC, \
+	 "");
 
 struct hb_closure_context_t
 {
+  inline const char *get_name (void) { return "CLOSURE"; }
+  static const unsigned int max_debug_depth = HB_DEBUG_CLOSURE;
+  typedef hb_void_t return_t;
+  typedef return_t (*recurse_func_t) (hb_closure_context_t *c, unsigned int lookup_index);
+  template <typename T>
+  inline return_t process (const T &obj) { obj.closure (this); return HB_VOID; }
+  static return_t default_return_value (void) { return HB_VOID; }
+  bool stop_sublookup_iteration (const return_t r HB_UNUSED) const { return false; }
+  return_t recurse (unsigned int lookup_index)
+  {
+    if (unlikely (nesting_level_left == 0 || !recurse_func))
+      return default_return_value ();
+
+    nesting_level_left--;
+    recurse_func (this, lookup_index);
+    nesting_level_left++;
+    return HB_VOID;
+  }
+
   hb_face_t *face;
   hb_set_t *glyphs;
+  recurse_func_t recurse_func;
   unsigned int nesting_level_left;
   unsigned int debug_depth;
 
-
   hb_closure_context_t (hb_face_t *face_,
 			hb_set_t *glyphs_,
 		        unsigned int nesting_level_left_ = MAX_NESTING_LEVEL) :
 			  face (face_),
 			  glyphs (glyphs_),
+			  recurse_func (NULL),
 			  nesting_level_left (nesting_level_left_),
 			  debug_depth (0) {}
+
+  void set_recurse_func (recurse_func_t func) { recurse_func = func; }
 };
 
 
 
-/* TODO Add TRACE_RETURN annotation to gsub. */
 #ifndef HB_DEBUG_WOULD_APPLY
 #define HB_DEBUG_WOULD_APPLY (HB_DEBUG+0)
 #endif
 
-#define TRACE_WOULD_APPLY() \
-	hb_auto_trace_t<HB_DEBUG_WOULD_APPLY> trace (&c->debug_depth, "WOULD_APPLY", this, HB_FUNC, "%d glyphs", c->len);
-
+#define TRACE_WOULD_APPLY(this) \
+	hb_auto_trace_t<HB_DEBUG_WOULD_APPLY, bool> trace \
+	(&c->debug_depth, c->get_name (), this, HB_FUNC, \
+	 "%d glyphs", c->len);
 
 struct hb_would_apply_context_t
 {
+  inline const char *get_name (void) { return "WOULD_APPLY"; }
+  static const unsigned int max_debug_depth = HB_DEBUG_WOULD_APPLY;
+  typedef bool return_t;
+  template <typename T>
+  inline return_t process (const T &obj) { return obj.would_apply (this); }
+  static return_t default_return_value (void) { return false; }
+  bool stop_sublookup_iteration (const return_t r) const { return r; }
+
   hb_face_t *face;
   const hb_codepoint_t *glyphs;
   unsigned int len;
@@ -89,31 +127,146 @@ struct hb_would_apply_context_t
 			      glyphs (glyphs_),
 			      len (len_),
 			      zero_context (zero_context_),
-			      debug_depth (0) {};
+			      debug_depth (0) {}
 };
 
 
+
+#ifndef HB_DEBUG_COLLECT_GLYPHS
+#define HB_DEBUG_COLLECT_GLYPHS (HB_DEBUG+0)
+#endif
+
+#define TRACE_COLLECT_GLYPHS(this) \
+	hb_auto_trace_t<HB_DEBUG_COLLECT_GLYPHS, hb_void_t> trace \
+	(&c->debug_depth, c->get_name (), this, HB_FUNC, \
+	 "");
+
+struct hb_collect_glyphs_context_t
+{
+  inline const char *get_name (void) { return "COLLECT_GLYPHS"; }
+  static const unsigned int max_debug_depth = HB_DEBUG_COLLECT_GLYPHS;
+  typedef hb_void_t return_t;
+  typedef return_t (*recurse_func_t) (hb_collect_glyphs_context_t *c, unsigned int lookup_index);
+  template <typename T>
+  inline return_t process (const T &obj) { obj.collect_glyphs (this); return HB_VOID; }
+  static return_t default_return_value (void) { return HB_VOID; }
+  bool stop_sublookup_iteration (const return_t r HB_UNUSED) const { return false; }
+  return_t recurse (unsigned int lookup_index)
+  {
+    if (unlikely (nesting_level_left == 0 || !recurse_func))
+      return default_return_value ();
+
+    /* Note that GPOS sets recurse_func to NULL already, so it doesn't get
+     * past the previous check.  For GSUB, we only want to collect the output
+     * glyphs in the recursion.  If output is not requested, we can go home now. */
+
+    if (output == hb_set_get_empty ())
+      return HB_VOID;
+
+    hb_set_t *old_before = before;
+    hb_set_t *old_input  = input;
+    hb_set_t *old_after  = after;
+    before = input = after = hb_set_get_empty ();
+
+    nesting_level_left--;
+    recurse_func (this, lookup_index);
+    nesting_level_left++;
+
+    before = old_before;
+    input  = old_input;
+    after  = old_after;
+
+    return HB_VOID;
+  }
+
+  hb_face_t *face;
+  hb_set_t *before;
+  hb_set_t *input;
+  hb_set_t *after;
+  hb_set_t *output;
+  recurse_func_t recurse_func;
+  unsigned int nesting_level_left;
+  unsigned int debug_depth;
+
+  hb_collect_glyphs_context_t (hb_face_t *face_,
+			       hb_set_t  *glyphs_before, /* OUT. May be NULL */
+			       hb_set_t  *glyphs_input,  /* OUT. May be NULL */
+			       hb_set_t  *glyphs_after,  /* OUT. May be NULL */
+			       hb_set_t  *glyphs_output, /* OUT. May be NULL */
+			       unsigned int nesting_level_left_ = MAX_NESTING_LEVEL) :
+			      face (face_),
+			      before (glyphs_before ? glyphs_before : hb_set_get_empty ()),
+			      input  (glyphs_input  ? glyphs_input  : hb_set_get_empty ()),
+			      after  (glyphs_after  ? glyphs_after  : hb_set_get_empty ()),
+			      output (glyphs_output ? glyphs_output : hb_set_get_empty ()),
+			      recurse_func (NULL),
+			      nesting_level_left (nesting_level_left_),
+			      debug_depth (0) {}
+
+  void set_recurse_func (recurse_func_t func) { recurse_func = func; }
+};
+
+
+
+struct hb_get_coverage_context_t
+{
+  inline const char *get_name (void) { return "GET_COVERAGE"; }
+  static const unsigned int max_debug_depth = 0;
+  typedef const Coverage &return_t;
+  template <typename T>
+  inline return_t process (const T &obj) { return obj.get_coverage (); }
+  static return_t default_return_value (void) { return Null(Coverage); }
+
+  hb_get_coverage_context_t (void) :
+			    debug_depth (0) {}
+
+  unsigned int debug_depth;
+};
+
+
+
 #ifndef HB_DEBUG_APPLY
 #define HB_DEBUG_APPLY (HB_DEBUG+0)
 #endif
 
-#define TRACE_APPLY() \
-	hb_auto_trace_t<HB_DEBUG_APPLY> trace (&c->debug_depth, "APPLY", this, HB_FUNC, "idx %d codepoint %u", c->buffer->idx, c->buffer->cur().codepoint);
-
+#define TRACE_APPLY(this) \
+	hb_auto_trace_t<HB_DEBUG_APPLY, bool> trace \
+	(&c->debug_depth, c->get_name (), this, HB_FUNC, \
+	 "idx %d codepoint %u", c->buffer->idx, c->buffer->cur().codepoint);
 
 struct hb_apply_context_t
 {
+  inline const char *get_name (void) { return "APPLY"; }
+  static const unsigned int max_debug_depth = HB_DEBUG_APPLY;
+  typedef bool return_t;
+  typedef return_t (*recurse_func_t) (hb_apply_context_t *c, unsigned int lookup_index);
+  template <typename T>
+  inline return_t process (const T &obj) { return obj.apply (this); }
+  static return_t default_return_value (void) { return false; }
+  bool stop_sublookup_iteration (const return_t r) const { return r; }
+  return_t recurse (unsigned int lookup_index)
+  {
+    if (unlikely (nesting_level_left == 0 || !recurse_func))
+      return default_return_value ();
+
+    nesting_level_left--;
+    bool ret = recurse_func (this, lookup_index);
+    nesting_level_left++;
+    return ret;
+  }
+
   hb_font_t *font;
   hb_face_t *face;
   hb_buffer_t *buffer;
   hb_direction_t direction;
   hb_mask_t lookup_mask;
+  recurse_func_t recurse_func;
   unsigned int nesting_level_left;
   unsigned int lookup_props;
   unsigned int property; /* propety of first glyph */
-  unsigned int debug_depth;
   const GDEF &gdef;
   bool has_glyph_classes;
+  unsigned int debug_depth;
 
 
   hb_apply_context_t (hb_font_t *font_,
@@ -122,18 +275,16 @@ struct hb_apply_context_t
 			font (font_), face (font->face), buffer (buffer_),
 			direction (buffer_->props.direction),
 			lookup_mask (lookup_mask_),
+			recurse_func (NULL),
 			nesting_level_left (MAX_NESTING_LEVEL),
-			lookup_props (0), property (0), debug_depth (0),
+			lookup_props (0), property (0),
 			gdef (*hb_ot_layout_from_face (face)->gdef),
-			has_glyph_classes (gdef.has_glyph_classes ()) {}
+			has_glyph_classes (gdef.has_glyph_classes ()),
+			debug_depth (0) {}
 
-  void set_lookup_props (unsigned int lookup_props_) {
-    lookup_props = lookup_props_;
-  }
-
-  void set_lookup (const Lookup &l) {
-    lookup_props = l.get_props ();
-  }
+  void set_recurse_func (recurse_func_t func) { recurse_func = func; }
+  void set_lookup_props (unsigned int lookup_props_) { lookup_props = lookup_props_; }
+  void set_lookup (const Lookup &l) { lookup_props = l.get_props (); }
 
   struct mark_skipping_forward_iterator_t
   {
@@ -264,7 +415,7 @@ struct hb_apply_context_t
     if (glyph_props & lookup_props & LookupFlag::IgnoreFlags)
       return false;
 
-    if (unlikely (glyph_props & HB_OT_LAYOUT_GLYPH_CLASS_MARK))
+    if (unlikely (glyph_props & HB_OT_LAYOUT_GLYPH_PROPS_MARK))
       return match_properties_mark (glyph, glyph_props, lookup_props);
 
     return true;
@@ -295,7 +446,7 @@ struct hb_apply_context_t
       *property_out = property;
 
     /* If it's a mark, skip it if we don't accept it. */
-    if (unlikely (property & HB_OT_LAYOUT_GLYPH_CLASS_MARK))
+    if (unlikely (property & HB_OT_LAYOUT_GLYPH_PROPS_MARK))
       return !match_properties (info->codepoint, property, lookup_props);
 
     /* If not a mark, don't skip. */
@@ -339,21 +490,23 @@ struct hb_apply_context_t
 
 
 typedef bool (*intersects_func_t) (hb_set_t *glyphs, const USHORT &value, const void *data);
+typedef void (*collect_glyphs_func_t) (hb_set_t *glyphs, const USHORT &value, const void *data);
 typedef bool (*match_func_t) (hb_codepoint_t glyph_id, const USHORT &value, const void *data);
-typedef void (*closure_lookup_func_t) (hb_closure_context_t *c, unsigned int lookup_index);
-typedef bool (*apply_lookup_func_t) (hb_apply_context_t *c, unsigned int lookup_index);
 
 struct ContextClosureFuncs
 {
   intersects_func_t intersects;
-  closure_lookup_func_t closure;
+};
+struct ContextCollectGlyphsFuncs
+{
+  collect_glyphs_func_t collect;
 };
 struct ContextApplyFuncs
 {
   match_func_t match;
-  apply_lookup_func_t apply;
 };
 
+
 static inline bool intersects_glyph (hb_set_t *glyphs, const USHORT &value, const void *data HB_UNUSED)
 {
   return glyphs->has (value);
@@ -382,6 +535,32 @@ static inline bool intersects_array (hb_closure_context_t *c,
 }
 
 
+static inline void collect_glyph (hb_set_t *glyphs, const USHORT &value, const void *data HB_UNUSED)
+{
+  glyphs->add (value);
+}
+static inline void collect_class (hb_set_t *glyphs, const USHORT &value, const void *data)
+{
+  const ClassDef &class_def = *reinterpret_cast<const ClassDef *>(data);
+  class_def.add_class (glyphs, value);
+}
+static inline void collect_coverage (hb_set_t *glyphs, const USHORT &value, const void *data)
+{
+  const OffsetTo<Coverage> &coverage = (const OffsetTo<Coverage>&)value;
+  (data+coverage).add_coverage (glyphs);
+}
+static inline void collect_array (hb_collect_glyphs_context_t *c HB_UNUSED,
+				  hb_set_t *glyphs,
+				  unsigned int count,
+				  const USHORT values[],
+				  collect_glyphs_func_t collect_func,
+				  const void *collect_data)
+{
+  for (unsigned int i = 0; i < count; i++)
+    collect_func (glyphs, values[i], collect_data);
+}
+
+
 static inline bool match_glyph (hb_codepoint_t glyph_id, const USHORT &value, const void *data HB_UNUSED)
 {
   return glyph_id == value;
@@ -397,7 +576,6 @@ static inline bool match_coverage (hb_codepoint_t glyph_id, const USHORT &value,
   return (data+coverage).get_coverage (glyph_id) != NOT_COVERED;
 }
 
-
 static inline bool would_match_input (hb_would_apply_context_t *c,
 				      unsigned int count, /* Including the first glyph (not matched) */
 				      const USHORT input[], /* Array of input values--start with second glyph */
@@ -422,7 +600,7 @@ static inline bool match_input (hb_apply_context_t *c,
 				bool *p_is_mark_ligature = NULL,
 				unsigned int *p_total_component_count = NULL)
 {
-  hb_auto_trace_t<HB_DEBUG_APPLY> trace (&c->debug_depth, "APPLY", NULL, HB_FUNC, "idx %d codepoint %u", c->buffer->idx, c->buffer->cur().codepoint);
+  TRACE_APPLY (NULL);
 
   hb_apply_context_t::mark_skipping_forward_iterator_t skippy_iter (c, c->buffer->idx, count - 1);
   if (skippy_iter.has_no_chance ()) return TRACE_RETURN (false);
@@ -445,7 +623,7 @@ static inline bool match_input (hb_apply_context_t *c,
    *   ligate with a conjunct...)
    */
 
-  bool is_mark_ligature = !!(c->property & HB_OT_LAYOUT_GLYPH_CLASS_MARK);
+  bool is_mark_ligature = !!(c->property & HB_OT_LAYOUT_GLYPH_PROPS_MARK);
 
   unsigned int total_component_count = 0;
   total_component_count += get_lig_num_comps (c->buffer->cur());
@@ -478,7 +656,7 @@ static inline bool match_input (hb_apply_context_t *c,
 	return TRACE_RETURN (false);
     }
 
-    is_mark_ligature = is_mark_ligature && (property & HB_OT_LAYOUT_GLYPH_CLASS_MARK);
+    is_mark_ligature = is_mark_ligature && (property & HB_OT_LAYOUT_GLYPH_PROPS_MARK);
     total_component_count += get_lig_num_comps (c->buffer->info[skippy_iter.idx]);
   }
 
@@ -495,10 +673,10 @@ static inline bool match_input (hb_apply_context_t *c,
 }
 static inline void ligate_input (hb_apply_context_t *c,
 				 unsigned int count, /* Including the first glyph (not matched) */
-				 const USHORT input[], /* Array of input values--start with second glyph */
+				 const USHORT input[] HB_UNUSED, /* Array of input values--start with second glyph */
 				 hb_codepoint_t lig_glyph,
-				 match_func_t match_func,
-				 const void *match_data,
+				 match_func_t match_func HB_UNUSED,
+				 const void *match_data HB_UNUSED,
 				 bool is_mark_ligature,
 				 unsigned int total_component_count)
 {
@@ -530,7 +708,7 @@ static inline void ligate_input (hb_apply_context_t *c,
    *   https://bugzilla.gnome.org/show_bug.cgi?id=437633
    */
 
-  unsigned int klass = is_mark_ligature ? 0 : HB_OT_LAYOUT_GLYPH_CLASS_LIGATURE;
+  unsigned int klass = is_mark_ligature ? 0 : HB_OT_LAYOUT_GLYPH_PROPS_LIGATURE;
   unsigned int lig_id = is_mark_ligature ? 0 : allocate_lig_id (c->buffer);
   unsigned int last_lig_id = get_lig_id (c->buffer->cur());
   unsigned int last_num_components = get_lig_num_comps (c->buffer->cur());
@@ -579,7 +757,7 @@ static inline bool match_backtrack (hb_apply_context_t *c,
 				    match_func_t match_func,
 				    const void *match_data)
 {
-  hb_auto_trace_t<HB_DEBUG_APPLY> trace (&c->debug_depth, "APPLY", NULL, HB_FUNC, "idx %d codepoint %u", c->buffer->idx, c->buffer->cur().codepoint);
+  TRACE_APPLY (NULL);
 
   hb_apply_context_t::mark_skipping_backward_iterator_t skippy_iter (c, c->buffer->backtrack_len (), count, true);
   if (skippy_iter.has_no_chance ())
@@ -604,7 +782,7 @@ static inline bool match_lookahead (hb_apply_context_t *c,
 				    const void *match_data,
 				    unsigned int offset)
 {
-  hb_auto_trace_t<HB_DEBUG_APPLY> trace (&c->debug_depth, "APPLY", NULL, HB_FUNC, "idx %d codepoint %u", c->buffer->idx, c->buffer->cur().codepoint);
+  TRACE_APPLY (NULL);
 
   hb_apply_context_t::mark_skipping_forward_iterator_t skippy_iter (c, c->buffer->idx + offset - 1, count, true);
   if (skippy_iter.has_no_chance ())
@@ -627,7 +805,7 @@ static inline bool match_lookahead (hb_apply_context_t *c,
 struct LookupRecord
 {
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this));
   }
 
@@ -640,22 +818,22 @@ struct LookupRecord
 };
 
 
-static inline void closure_lookup (hb_closure_context_t *c,
-				   unsigned int lookupCount,
-				   const LookupRecord lookupRecord[], /* Array of LookupRecords--in design order */
-				   closure_lookup_func_t closure_func)
+template <typename context_t>
+static inline void recurse_lookups (context_t *c,
+				    unsigned int lookupCount,
+				    const LookupRecord lookupRecord[] /* Array of LookupRecords--in design order */)
 {
   for (unsigned int i = 0; i < lookupCount; i++)
-    closure_func (c, lookupRecord->lookupListIndex);
+    c->recurse (lookupRecord->lookupListIndex);
 }
 
 static inline bool apply_lookup (hb_apply_context_t *c,
 				 unsigned int count, /* Including the first glyph */
 				 unsigned int lookupCount,
-				 const LookupRecord lookupRecord[], /* Array of LookupRecords--in design order */
-				 apply_lookup_func_t apply_func)
+				 const LookupRecord lookupRecord[] /* Array of LookupRecords--in design order */)
 {
-  hb_auto_trace_t<HB_DEBUG_APPLY> trace (&c->debug_depth, "APPLY", NULL, HB_FUNC, "idx %d codepoint %u", c->buffer->idx, c->buffer->cur().codepoint);
+  TRACE_APPLY (NULL);
+
   unsigned int end = c->buffer->len;
   if (unlikely (count == 0 || c->buffer->idx + count > end))
     return TRACE_RETURN (false);
@@ -684,7 +862,7 @@ static inline bool apply_lookup (hb_apply_context_t *c,
       unsigned int old_pos = c->buffer->idx;
 
       /* Apply a lookup */
-      bool done = apply_func (c, lookupRecord->lookupListIndex);
+      bool done = c->recurse (lookupRecord->lookupListIndex);
 
       lookupRecord++;
       lookupCount--;
@@ -718,6 +896,12 @@ struct ContextClosureLookupContext
   const void *intersects_data;
 };
 
+struct ContextCollectGlyphsLookupContext
+{
+  ContextCollectGlyphsFuncs funcs;
+  const void *collect_data;
+};
+
 struct ContextApplyLookupContext
 {
   ContextApplyFuncs funcs;
@@ -734,17 +918,29 @@ static inline void context_closure_lookup (hb_closure_context_t *c,
   if (intersects_array (c,
 			inputCount ? inputCount - 1 : 0, input,
 			lookup_context.funcs.intersects, lookup_context.intersects_data))
-    closure_lookup (c,
-		    lookupCount, lookupRecord,
-		    lookup_context.funcs.closure);
+    recurse_lookups (c,
+		     lookupCount, lookupRecord);
 }
 
+static inline void context_collect_glyphs_lookup (hb_collect_glyphs_context_t *c,
+						  unsigned int inputCount, /* Including the first glyph (not matched) */
+						  const USHORT input[], /* Array of input values--start with second glyph */
+						  unsigned int lookupCount,
+						  const LookupRecord lookupRecord[],
+						  ContextCollectGlyphsLookupContext &lookup_context)
+{
+  collect_array (c, c->input,
+		 inputCount ? inputCount - 1 : 0, input,
+		 lookup_context.funcs.collect, lookup_context.collect_data);
+  recurse_lookups (c,
+		   lookupCount, lookupRecord);
+}
 
 static inline bool context_would_apply_lookup (hb_would_apply_context_t *c,
 					       unsigned int inputCount, /* Including the first glyph (not matched) */
 					       const USHORT input[], /* Array of input values--start with second glyph */
-					       unsigned int lookupCount,
-					       const LookupRecord lookupRecord[],
+					       unsigned int lookupCount HB_UNUSED,
+					       const LookupRecord lookupRecord[] HB_UNUSED,
 					       ContextApplyLookupContext &lookup_context)
 {
   return would_match_input (c,
@@ -763,19 +959,14 @@ static inline bool context_apply_lookup (hb_apply_context_t *c,
 		      lookup_context.funcs.match, lookup_context.match_data)
       && apply_lookup (c,
 		       inputCount,
-		       lookupCount, lookupRecord,
-		       lookup_context.funcs.apply);
+		       lookupCount, lookupRecord);
 }
 
 struct Rule
 {
-  friend struct RuleSet;
-
-  private:
-
   inline void closure (hb_closure_context_t *c, ContextClosureLookupContext &lookup_context) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     const LookupRecord *lookupRecord = &StructAtOffset<LookupRecord> (input, input[0].static_size * (inputCount ? inputCount - 1 : 0));
     context_closure_lookup (c,
 			    inputCount, input,
@@ -783,23 +974,33 @@ struct Rule
 			    lookup_context);
   }
 
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c, ContextCollectGlyphsLookupContext &lookup_context) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    const LookupRecord *lookupRecord = &StructAtOffset<LookupRecord> (input, input[0].static_size * (inputCount ? inputCount - 1 : 0));
+    context_collect_glyphs_lookup (c,
+				   inputCount, input,
+				   lookupCount, lookupRecord,
+				   lookup_context);
+  }
+
   inline bool would_apply (hb_would_apply_context_t *c, ContextApplyLookupContext &lookup_context) const
   {
-    TRACE_WOULD_APPLY ();
+    TRACE_WOULD_APPLY (this);
     const LookupRecord *lookupRecord = &StructAtOffset<LookupRecord> (input, input[0].static_size * (inputCount ? inputCount - 1 : 0));
     return TRACE_RETURN (context_would_apply_lookup (c, inputCount, input, lookupCount, lookupRecord, lookup_context));
   }
 
   inline bool apply (hb_apply_context_t *c, ContextApplyLookupContext &lookup_context) const
   {
-    TRACE_APPLY ();
+    TRACE_APPLY (this);
     const LookupRecord *lookupRecord = &StructAtOffset<LookupRecord> (input, input[0].static_size * (inputCount ? inputCount - 1 : 0));
     return TRACE_RETURN (context_apply_lookup (c, inputCount, input, lookupCount, lookupRecord, lookup_context));
   }
 
   public:
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return inputCount.sanitize (c)
 	&& lookupCount.sanitize (c)
 	&& c->check_range (input,
@@ -824,15 +1025,23 @@ struct RuleSet
 {
   inline void closure (hb_closure_context_t *c, ContextClosureLookupContext &lookup_context) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     unsigned int num_rules = rule.len;
     for (unsigned int i = 0; i < num_rules; i++)
       (this+rule[i]).closure (c, lookup_context);
   }
 
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c, ContextCollectGlyphsLookupContext &lookup_context) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    unsigned int num_rules = rule.len;
+    for (unsigned int i = 0; i < num_rules; i++)
+      (this+rule[i]).collect_glyphs (c, lookup_context);
+  }
+
   inline bool would_apply (hb_would_apply_context_t *c, ContextApplyLookupContext &lookup_context) const
   {
-    TRACE_WOULD_APPLY ();
+    TRACE_WOULD_APPLY (this);
     unsigned int num_rules = rule.len;
     for (unsigned int i = 0; i < num_rules; i++)
     {
@@ -844,7 +1053,7 @@ struct RuleSet
 
   inline bool apply (hb_apply_context_t *c, ContextApplyLookupContext &lookup_context) const
   {
-    TRACE_APPLY ();
+    TRACE_APPLY (this);
     unsigned int num_rules = rule.len;
     for (unsigned int i = 0; i < num_rules; i++)
     {
@@ -855,7 +1064,7 @@ struct RuleSet
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (rule.sanitize (c, this));
   }
 
@@ -870,18 +1079,14 @@ struct RuleSet
 
 struct ContextFormat1
 {
-  friend struct Context;
-
-  private:
-
-  inline void closure (hb_closure_context_t *c, closure_lookup_func_t closure_func) const
+  inline void closure (hb_closure_context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
 
     const Coverage &cov = (this+coverage);
 
     struct ContextClosureLookupContext lookup_context = {
-      {intersects_glyph, closure_func},
+      {intersects_glyph},
       NULL
     };
 
@@ -893,35 +1098,55 @@ struct ContextFormat1
       }
   }
 
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    (this+coverage).add_coverage (c->input);
+
+    struct ContextCollectGlyphsLookupContext lookup_context = {
+      {collect_glyph},
+      NULL
+    };
+
+    unsigned int count = ruleSet.len;
+    for (unsigned int i = 0; i < count; i++)
+      (this+ruleSet[i]).collect_glyphs (c, lookup_context);
+  }
+
   inline bool would_apply (hb_would_apply_context_t *c) const
   {
-    TRACE_WOULD_APPLY ();
+    TRACE_WOULD_APPLY (this);
 
-    const RuleSet &rule_set = this+ruleSet[(this+coverage) (c->glyphs[0])];
+    const RuleSet &rule_set = this+ruleSet[(this+coverage).get_coverage (c->glyphs[0])];
     struct ContextApplyLookupContext lookup_context = {
-      {match_glyph, NULL},
+      {match_glyph},
       NULL
     };
     return TRACE_RETURN (rule_set.would_apply (c, lookup_context));
   }
 
-  inline bool apply (hb_apply_context_t *c, apply_lookup_func_t apply_func) const
+  inline const Coverage &get_coverage (void) const
   {
-    TRACE_APPLY ();
-    unsigned int index = (this+coverage) (c->buffer->cur().codepoint);
+    return this+coverage;
+  }
+
+  inline bool apply (hb_apply_context_t *c) const
+  {
+    TRACE_APPLY (this);
+    unsigned int index = (this+coverage).get_coverage (c->buffer->cur().codepoint);
     if (likely (index == NOT_COVERED))
       return TRACE_RETURN (false);
 
     const RuleSet &rule_set = this+ruleSet[index];
     struct ContextApplyLookupContext lookup_context = {
-      {match_glyph, apply_func},
+      {match_glyph},
       NULL
     };
     return TRACE_RETURN (rule_set.apply (c, lookup_context));
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (coverage.sanitize (c, this) && ruleSet.sanitize (c, this));
   }
 
@@ -940,21 +1165,17 @@ struct ContextFormat1
 
 struct ContextFormat2
 {
-  friend struct Context;
-
-  private:
-
-  inline void closure (hb_closure_context_t *c, closure_lookup_func_t closure_func) const
+  inline void closure (hb_closure_context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     if (!(this+coverage).intersects (c->glyphs))
       return;
 
     const ClassDef &class_def = this+classDef;
 
     struct ContextClosureLookupContext lookup_context = {
-      {intersects_class, closure_func},
-      NULL
+      {intersects_class},
+      &class_def
     };
 
     unsigned int count = ruleSet.len;
@@ -965,38 +1186,59 @@ struct ContextFormat2
       }
   }
 
-  inline bool would_apply (hb_would_apply_context_t *c) const
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
   {
-    TRACE_WOULD_APPLY ();
+    TRACE_COLLECT_GLYPHS (this);
+    (this+coverage).add_coverage (c->input);
 
     const ClassDef &class_def = this+classDef;
-    unsigned int index = class_def (c->glyphs[0]);
+    struct ContextCollectGlyphsLookupContext lookup_context = {
+      {collect_class},
+      &class_def
+    };
+
+    unsigned int count = ruleSet.len;
+    for (unsigned int i = 0; i < count; i++)
+      (this+ruleSet[i]).collect_glyphs (c, lookup_context);
+  }
+
+  inline bool would_apply (hb_would_apply_context_t *c) const
+  {
+    TRACE_WOULD_APPLY (this);
+
+    const ClassDef &class_def = this+classDef;
+    unsigned int index = class_def.get_class (c->glyphs[0]);
     const RuleSet &rule_set = this+ruleSet[index];
     struct ContextApplyLookupContext lookup_context = {
-      {match_class, NULL},
+      {match_class},
       &class_def
     };
     return TRACE_RETURN (rule_set.would_apply (c, lookup_context));
   }
 
-  inline bool apply (hb_apply_context_t *c, apply_lookup_func_t apply_func) const
+  inline const Coverage &get_coverage (void) const
   {
-    TRACE_APPLY ();
-    unsigned int index = (this+coverage) (c->buffer->cur().codepoint);
+    return this+coverage;
+  }
+
+  inline bool apply (hb_apply_context_t *c) const
+  {
+    TRACE_APPLY (this);
+    unsigned int index = (this+coverage).get_coverage (c->buffer->cur().codepoint);
     if (likely (index == NOT_COVERED)) return TRACE_RETURN (false);
 
     const ClassDef &class_def = this+classDef;
-    index = class_def (c->buffer->cur().codepoint);
+    index = class_def.get_class (c->buffer->cur().codepoint);
     const RuleSet &rule_set = this+ruleSet[index];
     struct ContextApplyLookupContext lookup_context = {
-      {match_class, apply_func},
+      {match_class},
       &class_def
     };
     return TRACE_RETURN (rule_set.apply (c, lookup_context));
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (coverage.sanitize (c, this) && classDef.sanitize (c, this) && ruleSet.sanitize (c, this));
   }
 
@@ -1018,19 +1260,15 @@ struct ContextFormat2
 
 struct ContextFormat3
 {
-  friend struct Context;
-
-  private:
-
-  inline void closure (hb_closure_context_t *c, closure_lookup_func_t closure_func) const
+  inline void closure (hb_closure_context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     if (!(this+coverage[0]).intersects (c->glyphs))
       return;
 
     const LookupRecord *lookupRecord = &StructAtOffset<LookupRecord> (coverage, coverage[0].static_size * glyphCount);
     struct ContextClosureLookupContext lookup_context = {
-      {intersects_coverage, closure_func},
+      {intersects_coverage},
       this
     };
     context_closure_lookup (c,
@@ -1039,34 +1277,56 @@ struct ContextFormat3
 			    lookup_context);
   }
 
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    (this+coverage[0]).add_coverage (c->input);
+
+    const LookupRecord *lookupRecord = &StructAtOffset<LookupRecord> (coverage, coverage[0].static_size * glyphCount);
+    struct ContextCollectGlyphsLookupContext lookup_context = {
+      {collect_coverage},
+      this
+    };
+
+    context_collect_glyphs_lookup (c,
+				   glyphCount, (const USHORT *) (coverage + 1),
+				   lookupCount, lookupRecord,
+				   lookup_context);
+  }
+
   inline bool would_apply (hb_would_apply_context_t *c) const
   {
-    TRACE_WOULD_APPLY ();
+    TRACE_WOULD_APPLY (this);
 
     const LookupRecord *lookupRecord = &StructAtOffset<LookupRecord> (coverage, coverage[0].static_size * glyphCount);
     struct ContextApplyLookupContext lookup_context = {
-      {match_coverage, NULL},
+      {match_coverage},
       this
     };
     return TRACE_RETURN (context_would_apply_lookup (c, glyphCount, (const USHORT *) (coverage + 1), lookupCount, lookupRecord, lookup_context));
   }
 
-  inline bool apply (hb_apply_context_t *c, apply_lookup_func_t apply_func) const
+  inline const Coverage &get_coverage (void) const
   {
-    TRACE_APPLY ();
-    unsigned int index = (this+coverage[0]) (c->buffer->cur().codepoint);
+    return this+coverage[0];
+  }
+
+  inline bool apply (hb_apply_context_t *c) const
+  {
+    TRACE_APPLY (this);
+    unsigned int index = (this+coverage[0]).get_coverage (c->buffer->cur().codepoint);
     if (likely (index == NOT_COVERED)) return TRACE_RETURN (false);
 
     const LookupRecord *lookupRecord = &StructAtOffset<LookupRecord> (coverage, coverage[0].static_size * glyphCount);
     struct ContextApplyLookupContext lookup_context = {
-      {match_coverage, apply_func},
+      {match_coverage},
       this
     };
     return TRACE_RETURN (context_apply_lookup (c, glyphCount, (const USHORT *) (coverage + 1), lookupCount, lookupRecord, lookup_context));
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!c->check_struct (this)) return TRACE_RETURN (false);
     unsigned int count = glyphCount;
     if (!c->check_array (coverage, coverage[0].static_size, count)) return TRACE_RETURN (false);
@@ -1092,52 +1352,20 @@ struct ContextFormat3
 
 struct Context
 {
-  protected:
-
-  inline void closure (hb_closure_context_t *c, closure_lookup_func_t closure_func) const
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_PROCESS (this);
     switch (u.format) {
-    case 1: u.format1.closure (c, closure_func); break;
-    case 2: u.format2.closure (c, closure_func); break;
-    case 3: u.format3.closure (c, closure_func); break;
-    default:                                     break;
-    }
-  }
-
-  inline const Coverage &get_coverage (void) const
-  {
-    switch (u.format) {
-    case 1: return this + u.format1.coverage;
-    case 2: return this + u.format2.coverage;
-    case 3: return this + u.format3.coverage[0];
-    default:return Null(Coverage);
-    }
-  }
-
-  inline bool would_apply (hb_would_apply_context_t *c) const
-  {
-    switch (u.format) {
-    case 1: return u.format1.would_apply (c);
-    case 2: return u.format2.would_apply (c);
-    case 3: return u.format3.would_apply (c);
-    default:return false;
-    }
-  }
-
-  inline bool apply (hb_apply_context_t *c, apply_lookup_func_t apply_func) const
-  {
-    TRACE_APPLY ();
-    switch (u.format) {
-    case 1: return TRACE_RETURN (u.format1.apply (c, apply_func));
-    case 2: return TRACE_RETURN (u.format2.apply (c, apply_func));
-    case 3: return TRACE_RETURN (u.format3.apply (c, apply_func));
-    default:return TRACE_RETURN (false);
+    case 1: return TRACE_RETURN (c->process (u.format1));
+    case 2: return TRACE_RETURN (c->process (u.format2));
+    case 3: return TRACE_RETURN (c->process (u.format3));
+    default:return TRACE_RETURN (c->default_return_value ());
     }
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -1165,6 +1393,12 @@ struct ChainContextClosureLookupContext
   const void *intersects_data[3];
 };
 
+struct ChainContextCollectGlyphsLookupContext
+{
+  ContextCollectGlyphsFuncs funcs;
+  const void *collect_data[3];
+};
+
 struct ChainContextApplyLookupContext
 {
   ContextApplyFuncs funcs;
@@ -1191,20 +1425,43 @@ static inline void chain_context_closure_lookup (hb_closure_context_t *c,
   && intersects_array (c,
 		       lookaheadCount, lookahead,
 		       lookup_context.funcs.intersects, lookup_context.intersects_data[2]))
-    closure_lookup (c,
-		    lookupCount, lookupRecord,
-		    lookup_context.funcs.closure);
+    recurse_lookups (c,
+		     lookupCount, lookupRecord);
+}
+
+static inline void chain_context_collect_glyphs_lookup (hb_collect_glyphs_context_t *c,
+						        unsigned int backtrackCount,
+						        const USHORT backtrack[],
+						        unsigned int inputCount, /* Including the first glyph (not matched) */
+						        const USHORT input[], /* Array of input values--start with second glyph */
+						        unsigned int lookaheadCount,
+						        const USHORT lookahead[],
+						        unsigned int lookupCount,
+						        const LookupRecord lookupRecord[],
+						        ChainContextCollectGlyphsLookupContext &lookup_context)
+{
+  collect_array (c, c->before,
+		 backtrackCount, backtrack,
+		 lookup_context.funcs.collect, lookup_context.collect_data[0]);
+  collect_array (c, c->input,
+		 inputCount ? inputCount - 1 : 0, input,
+		 lookup_context.funcs.collect, lookup_context.collect_data[1]);
+  collect_array (c, c->after,
+		 lookaheadCount, lookahead,
+		 lookup_context.funcs.collect, lookup_context.collect_data[2]);
+  recurse_lookups (c,
+		   lookupCount, lookupRecord);
 }
 
 static inline bool chain_context_would_apply_lookup (hb_would_apply_context_t *c,
 						     unsigned int backtrackCount,
-						     const USHORT backtrack[],
+						     const USHORT backtrack[] HB_UNUSED,
 						     unsigned int inputCount, /* Including the first glyph (not matched) */
 						     const USHORT input[], /* Array of input values--start with second glyph */
 						     unsigned int lookaheadCount,
-						     const USHORT lookahead[],
-						     unsigned int lookupCount,
-						     const LookupRecord lookupRecord[],
+						     const USHORT lookahead[] HB_UNUSED,
+						     unsigned int lookupCount HB_UNUSED,
+						     const LookupRecord lookupRecord[] HB_UNUSED,
 						     ChainContextApplyLookupContext &lookup_context)
 {
   return (c->zero_context ? !backtrackCount && !lookaheadCount : true)
@@ -1224,7 +1481,7 @@ static inline bool chain_context_apply_lookup (hb_apply_context_t *c,
 					       const LookupRecord lookupRecord[],
 					       ChainContextApplyLookupContext &lookup_context)
 {
-  unsigned int lookahead_offset;
+  unsigned int lookahead_offset = 0;
   return match_input (c,
 		      inputCount, input,
 		      lookup_context.funcs.match, lookup_context.match_data[1],
@@ -1238,19 +1495,14 @@ static inline bool chain_context_apply_lookup (hb_apply_context_t *c,
 			  lookahead_offset)
       && apply_lookup (c,
 		       inputCount,
-		       lookupCount, lookupRecord,
-		       lookup_context.funcs.apply);
+		       lookupCount, lookupRecord);
 }
 
 struct ChainRule
 {
-  friend struct ChainRuleSet;
-
-  private:
-
   inline void closure (hb_closure_context_t *c, ChainContextClosureLookupContext &lookup_context) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     const HeadlessArrayOf<USHORT> &input = StructAfter<HeadlessArrayOf<USHORT> > (backtrack);
     const ArrayOf<USHORT> &lookahead = StructAfter<ArrayOf<USHORT> > (input);
     const ArrayOf<LookupRecord> &lookup = StructAfter<ArrayOf<LookupRecord> > (lookahead);
@@ -1262,9 +1514,23 @@ struct ChainRule
 				  lookup_context);
   }
 
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c, ChainContextCollectGlyphsLookupContext &lookup_context) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    const HeadlessArrayOf<USHORT> &input = StructAfter<HeadlessArrayOf<USHORT> > (backtrack);
+    const ArrayOf<USHORT> &lookahead = StructAfter<ArrayOf<USHORT> > (input);
+    const ArrayOf<LookupRecord> &lookup = StructAfter<ArrayOf<LookupRecord> > (lookahead);
+    chain_context_collect_glyphs_lookup (c,
+					 backtrack.len, backtrack.array,
+					 input.len, input.array,
+					 lookahead.len, lookahead.array,
+					 lookup.len, lookup.array,
+					 lookup_context);
+  }
+
   inline bool would_apply (hb_would_apply_context_t *c, ChainContextApplyLookupContext &lookup_context) const
   {
-    TRACE_WOULD_APPLY ();
+    TRACE_WOULD_APPLY (this);
     const HeadlessArrayOf<USHORT> &input = StructAfter<HeadlessArrayOf<USHORT> > (backtrack);
     const ArrayOf<USHORT> &lookahead = StructAfter<ArrayOf<USHORT> > (input);
     const ArrayOf<LookupRecord> &lookup = StructAfter<ArrayOf<LookupRecord> > (lookahead);
@@ -1277,7 +1543,7 @@ struct ChainRule
 
   inline bool apply (hb_apply_context_t *c, ChainContextApplyLookupContext &lookup_context) const
   {
-    TRACE_APPLY ();
+    TRACE_APPLY (this);
     const HeadlessArrayOf<USHORT> &input = StructAfter<HeadlessArrayOf<USHORT> > (backtrack);
     const ArrayOf<USHORT> &lookahead = StructAfter<ArrayOf<USHORT> > (input);
     const ArrayOf<LookupRecord> &lookup = StructAfter<ArrayOf<LookupRecord> > (lookahead);
@@ -1288,9 +1554,8 @@ struct ChainRule
 						     lookup.array, lookup_context));
   }
 
-  public:
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!backtrack.sanitize (c)) return TRACE_RETURN (false);
     HeadlessArrayOf<USHORT> &input = StructAfter<HeadlessArrayOf<USHORT> > (backtrack);
     if (!input.sanitize (c)) return TRACE_RETURN (false);
@@ -1322,15 +1587,23 @@ struct ChainRuleSet
 {
   inline void closure (hb_closure_context_t *c, ChainContextClosureLookupContext &lookup_context) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     unsigned int num_rules = rule.len;
     for (unsigned int i = 0; i < num_rules; i++)
       (this+rule[i]).closure (c, lookup_context);
   }
 
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c, ChainContextCollectGlyphsLookupContext &lookup_context) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    unsigned int num_rules = rule.len;
+    for (unsigned int i = 0; i < num_rules; i++)
+      (this+rule[i]).collect_glyphs (c, lookup_context);
+  }
+
   inline bool would_apply (hb_would_apply_context_t *c, ChainContextApplyLookupContext &lookup_context) const
   {
-    TRACE_WOULD_APPLY ();
+    TRACE_WOULD_APPLY (this);
     unsigned int num_rules = rule.len;
     for (unsigned int i = 0; i < num_rules; i++)
       if ((this+rule[i]).would_apply (c, lookup_context))
@@ -1341,7 +1614,7 @@ struct ChainRuleSet
 
   inline bool apply (hb_apply_context_t *c, ChainContextApplyLookupContext &lookup_context) const
   {
-    TRACE_APPLY ();
+    TRACE_APPLY (this);
     unsigned int num_rules = rule.len;
     for (unsigned int i = 0; i < num_rules; i++)
       if ((this+rule[i]).apply (c, lookup_context))
@@ -1351,7 +1624,7 @@ struct ChainRuleSet
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (rule.sanitize (c, this));
   }
 
@@ -1365,17 +1638,13 @@ struct ChainRuleSet
 
 struct ChainContextFormat1
 {
-  friend struct ChainContext;
-
-  private:
-
-  inline void closure (hb_closure_context_t *c, closure_lookup_func_t closure_func) const
+  inline void closure (hb_closure_context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     const Coverage &cov = (this+coverage);
 
     struct ChainContextClosureLookupContext lookup_context = {
-      {intersects_glyph, closure_func},
+      {intersects_glyph},
       {NULL, NULL, NULL}
     };
 
@@ -1387,34 +1656,54 @@ struct ChainContextFormat1
       }
   }
 
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    (this+coverage).add_coverage (c->input);
+
+    struct ChainContextCollectGlyphsLookupContext lookup_context = {
+      {collect_glyph},
+      {NULL, NULL, NULL}
+    };
+
+    unsigned int count = ruleSet.len;
+    for (unsigned int i = 0; i < count; i++)
+      (this+ruleSet[i]).collect_glyphs (c, lookup_context);
+  }
+
   inline bool would_apply (hb_would_apply_context_t *c) const
   {
-    TRACE_WOULD_APPLY ();
+    TRACE_WOULD_APPLY (this);
 
-    const ChainRuleSet &rule_set = this+ruleSet[(this+coverage) (c->glyphs[0])];
+    const ChainRuleSet &rule_set = this+ruleSet[(this+coverage).get_coverage (c->glyphs[0])];
     struct ChainContextApplyLookupContext lookup_context = {
-      {match_glyph, NULL},
+      {match_glyph},
       {NULL, NULL, NULL}
     };
     return TRACE_RETURN (rule_set.would_apply (c, lookup_context));
   }
 
-  inline bool apply (hb_apply_context_t *c, apply_lookup_func_t apply_func) const
+  inline const Coverage &get_coverage (void) const
   {
-    TRACE_APPLY ();
-    unsigned int index = (this+coverage) (c->buffer->cur().codepoint);
+    return this+coverage;
+  }
+
+  inline bool apply (hb_apply_context_t *c) const
+  {
+    TRACE_APPLY (this);
+    unsigned int index = (this+coverage).get_coverage (c->buffer->cur().codepoint);
     if (likely (index == NOT_COVERED)) return TRACE_RETURN (false);
 
     const ChainRuleSet &rule_set = this+ruleSet[index];
     struct ChainContextApplyLookupContext lookup_context = {
-      {match_glyph, apply_func},
+      {match_glyph},
       {NULL, NULL, NULL}
     };
     return TRACE_RETURN (rule_set.apply (c, lookup_context));
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (coverage.sanitize (c, this) && ruleSet.sanitize (c, this));
   }
 
@@ -1432,13 +1721,9 @@ struct ChainContextFormat1
 
 struct ChainContextFormat2
 {
-  friend struct ChainContext;
-
-  private:
-
-  inline void closure (hb_closure_context_t *c, closure_lookup_func_t closure_func) const
+  inline void closure (hb_closure_context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     if (!(this+coverage).intersects (c->glyphs))
       return;
 
@@ -1447,7 +1732,7 @@ struct ChainContextFormat2
     const ClassDef &lookahead_class_def = this+lookaheadClassDef;
 
     struct ChainContextClosureLookupContext lookup_context = {
-      {intersects_class, closure_func},
+      {intersects_class},
       {&backtrack_class_def,
        &input_class_def,
        &lookahead_class_def}
@@ -1461,35 +1746,65 @@ struct ChainContextFormat2
       }
   }
 
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
+  {
+    TRACE_COLLECT_GLYPHS (this);
+    (this+coverage).add_coverage (c->input);
+
+    const ClassDef &backtrack_class_def = this+backtrackClassDef;
+    const ClassDef &input_class_def = this+inputClassDef;
+    const ClassDef &lookahead_class_def = this+lookaheadClassDef;
+
+    struct ChainContextCollectGlyphsLookupContext lookup_context = {
+      {collect_class},
+      {&backtrack_class_def,
+       &input_class_def,
+       &lookahead_class_def}
+    };
+
+    unsigned int count = ruleSet.len;
+    for (unsigned int i = 0; i < count; i++)
+      (this+ruleSet[i]).collect_glyphs (c, lookup_context);
+  }
+
   inline bool would_apply (hb_would_apply_context_t *c) const
   {
-    TRACE_WOULD_APPLY ();
+    TRACE_WOULD_APPLY (this);
 
+    const ClassDef &backtrack_class_def = this+backtrackClassDef;
     const ClassDef &input_class_def = this+inputClassDef;
+    const ClassDef &lookahead_class_def = this+lookaheadClassDef;
 
-    unsigned int index = input_class_def (c->glyphs[0]);
+    unsigned int index = input_class_def.get_class (c->glyphs[0]);
     const ChainRuleSet &rule_set = this+ruleSet[index];
     struct ChainContextApplyLookupContext lookup_context = {
-      {match_class, NULL},
-      {NULL, &input_class_def, NULL}
+      {match_class},
+      {&backtrack_class_def,
+       &input_class_def,
+       &lookahead_class_def}
     };
     return TRACE_RETURN (rule_set.would_apply (c, lookup_context));
   }
 
-  inline bool apply (hb_apply_context_t *c, apply_lookup_func_t apply_func) const
+  inline const Coverage &get_coverage (void) const
   {
-    TRACE_APPLY ();
-    unsigned int index = (this+coverage) (c->buffer->cur().codepoint);
+    return this+coverage;
+  }
+
+  inline bool apply (hb_apply_context_t *c) const
+  {
+    TRACE_APPLY (this);
+    unsigned int index = (this+coverage).get_coverage (c->buffer->cur().codepoint);
     if (likely (index == NOT_COVERED)) return TRACE_RETURN (false);
 
     const ClassDef &backtrack_class_def = this+backtrackClassDef;
     const ClassDef &input_class_def = this+inputClassDef;
     const ClassDef &lookahead_class_def = this+lookaheadClassDef;
 
-    index = input_class_def (c->buffer->cur().codepoint);
+    index = input_class_def.get_class (c->buffer->cur().codepoint);
     const ChainRuleSet &rule_set = this+ruleSet[index];
     struct ChainContextApplyLookupContext lookup_context = {
-      {match_class, apply_func},
+      {match_class},
       {&backtrack_class_def,
        &input_class_def,
        &lookahead_class_def}
@@ -1498,7 +1813,7 @@ struct ChainContextFormat2
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (coverage.sanitize (c, this) && backtrackClassDef.sanitize (c, this) &&
 			 inputClassDef.sanitize (c, this) && lookaheadClassDef.sanitize (c, this) &&
 			 ruleSet.sanitize (c, this));
@@ -1530,13 +1845,9 @@ struct ChainContextFormat2
 
 struct ChainContextFormat3
 {
-  friend struct ChainContext;
-
-  private:
-
-  inline void closure (hb_closure_context_t *c, closure_lookup_func_t closure_func) const
+  inline void closure (hb_closure_context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_CLOSURE (this);
     const OffsetArrayOf<Coverage> &input = StructAfter<OffsetArrayOf<Coverage> > (backtrack);
 
     if (!(this+input[0]).intersects (c->glyphs))
@@ -1545,7 +1856,7 @@ struct ChainContextFormat3
     const OffsetArrayOf<Coverage> &lookahead = StructAfter<OffsetArrayOf<Coverage> > (input);
     const ArrayOf<LookupRecord> &lookup = StructAfter<ArrayOf<LookupRecord> > (lookahead);
     struct ChainContextClosureLookupContext lookup_context = {
-      {intersects_coverage, closure_func},
+      {intersects_coverage},
       {this, this, this}
     };
     chain_context_closure_lookup (c,
@@ -1556,21 +1867,36 @@ struct ChainContextFormat3
 				  lookup_context);
   }
 
-  inline const Coverage &get_coverage (void) const
+  inline void collect_glyphs (hb_collect_glyphs_context_t *c) const
   {
+    TRACE_COLLECT_GLYPHS (this);
     const OffsetArrayOf<Coverage> &input = StructAfter<OffsetArrayOf<Coverage> > (backtrack);
-    return this+input[0];
+
+    (this+input[0]).add_coverage (c->input);
+
+    const OffsetArrayOf<Coverage> &lookahead = StructAfter<OffsetArrayOf<Coverage> > (input);
+    const ArrayOf<LookupRecord> &lookup = StructAfter<ArrayOf<LookupRecord> > (lookahead);
+    struct ChainContextCollectGlyphsLookupContext lookup_context = {
+      {collect_coverage},
+      {this, this, this}
+    };
+    chain_context_collect_glyphs_lookup (c,
+					 backtrack.len, (const USHORT *) backtrack.array,
+					 input.len, (const USHORT *) input.array + 1,
+					 lookahead.len, (const USHORT *) lookahead.array,
+					 lookup.len, lookup.array,
+					 lookup_context);
   }
 
   inline bool would_apply (hb_would_apply_context_t *c) const
   {
-    TRACE_WOULD_APPLY ();
+    TRACE_WOULD_APPLY (this);
 
     const OffsetArrayOf<Coverage> &input = StructAfter<OffsetArrayOf<Coverage> > (backtrack);
     const OffsetArrayOf<Coverage> &lookahead = StructAfter<OffsetArrayOf<Coverage> > (input);
     const ArrayOf<LookupRecord> &lookup = StructAfter<ArrayOf<LookupRecord> > (lookahead);
     struct ChainContextApplyLookupContext lookup_context = {
-      {match_coverage, NULL},
+      {match_coverage},
       {this, this, this}
     };
     return TRACE_RETURN (chain_context_would_apply_lookup (c,
@@ -1580,18 +1906,24 @@ struct ChainContextFormat3
 							   lookup.len, lookup.array, lookup_context));
   }
 
-  inline bool apply (hb_apply_context_t *c, apply_lookup_func_t apply_func) const
+  inline const Coverage &get_coverage (void) const
   {
-    TRACE_APPLY ();
+    const OffsetArrayOf<Coverage> &input = StructAfter<OffsetArrayOf<Coverage> > (backtrack);
+    return this+input[0];
+  }
+
+  inline bool apply (hb_apply_context_t *c) const
+  {
+    TRACE_APPLY (this);
     const OffsetArrayOf<Coverage> &input = StructAfter<OffsetArrayOf<Coverage> > (backtrack);
 
-    unsigned int index = (this+input[0]) (c->buffer->cur().codepoint);
+    unsigned int index = (this+input[0]).get_coverage (c->buffer->cur().codepoint);
     if (likely (index == NOT_COVERED)) return TRACE_RETURN (false);
 
     const OffsetArrayOf<Coverage> &lookahead = StructAfter<OffsetArrayOf<Coverage> > (input);
     const ArrayOf<LookupRecord> &lookup = StructAfter<ArrayOf<LookupRecord> > (lookahead);
     struct ChainContextApplyLookupContext lookup_context = {
-      {match_coverage, apply_func},
+      {match_coverage},
       {this, this, this}
     };
     return TRACE_RETURN (chain_context_apply_lookup (c,
@@ -1602,7 +1934,7 @@ struct ChainContextFormat3
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!backtrack.sanitize (c, this)) return TRACE_RETURN (false);
     OffsetArrayOf<Coverage> &input = StructAfter<OffsetArrayOf<Coverage> > (backtrack);
     if (!input.sanitize (c, this)) return TRACE_RETURN (false);
@@ -1635,52 +1967,20 @@ struct ChainContextFormat3
 
 struct ChainContext
 {
-  protected:
-
-  inline void closure (hb_closure_context_t *c, closure_lookup_func_t closure_func) const
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c) const
   {
-    TRACE_CLOSURE ();
+    TRACE_PROCESS (this);
     switch (u.format) {
-    case 1: u.format1.closure (c, closure_func); break;
-    case 2: u.format2.closure (c, closure_func); break;
-    case 3: u.format3.closure (c, closure_func); break;
-    default:                                     break;
-    }
-  }
-
-  inline const Coverage &get_coverage (void) const
-  {
-    switch (u.format) {
-    case 1: return this + u.format1.coverage;
-    case 2: return this + u.format2.coverage;
-    case 3: return u.format3.get_coverage ();
-    default:return Null(Coverage);
-    }
-  }
-
-  inline bool would_apply (hb_would_apply_context_t *c) const
-  {
-    switch (u.format) {
-    case 1: return u.format1.would_apply (c);
-    case 2: return u.format2.would_apply (c);
-    case 3: return u.format3.would_apply (c);
-    default:return false;
-    }
-  }
-
-  inline bool apply (hb_apply_context_t *c, apply_lookup_func_t apply_func) const
-  {
-    TRACE_APPLY ();
-    switch (u.format) {
-    case 1: return TRACE_RETURN (u.format1.apply (c, apply_func));
-    case 2: return TRACE_RETURN (u.format2.apply (c, apply_func));
-    case 3: return TRACE_RETURN (u.format3.apply (c, apply_func));
-    default:return TRACE_RETURN (false);
+    case 1: return TRACE_RETURN (c->process (u.format1));
+    case 2: return TRACE_RETURN (c->process (u.format2));
+    case 3: return TRACE_RETURN (c->process (u.format3));
+    default:return TRACE_RETURN (c->default_return_value ());
     }
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -1702,14 +2002,11 @@ struct ChainContext
 
 struct ExtensionFormat1
 {
-  friend struct Extension;
-
-  protected:
   inline unsigned int get_type (void) const { return extensionLookupType; }
   inline unsigned int get_offset (void) const { return extensionOffset; }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this));
   }
 
@@ -1724,6 +2021,7 @@ struct ExtensionFormat1
   DEFINE_SIZE_STATIC (8);
 };
 
+template <typename T>
 struct Extension
 {
   inline unsigned int get_type (void) const
@@ -1741,8 +2039,22 @@ struct Extension
     }
   }
 
-  inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+  template <typename X>
+  inline const X& get_subtable (void) const
+  {
+    unsigned int offset = get_offset ();
+    if (unlikely (!offset)) return Null(typename T::LookupSubTable);
+    return StructAtOffset<typename T::LookupSubTable> (this, offset);
+  }
+
+  template <typename context_t>
+  inline typename context_t::return_t process (context_t *c) const
+  {
+    return get_subtable<typename T::LookupSubTable> ().process (c, get_type ());
+  }
+
+  inline bool sanitize_self (hb_sanitize_context_t *c) {
+    TRACE_SANITIZE (this);
     if (!u.format.sanitize (c)) return TRACE_RETURN (false);
     switch (u.format) {
     case 1: return TRACE_RETURN (u.format1.sanitize (c));
@@ -1750,6 +2062,14 @@ struct Extension
     }
   }
 
+  inline bool sanitize (hb_sanitize_context_t *c) {
+    TRACE_SANITIZE (this);
+    if (!sanitize_self (c)) return TRACE_RETURN (false);
+    unsigned int offset = get_offset ();
+    if (unlikely (!offset)) return TRACE_RETURN (true);
+    return TRACE_RETURN (StructAtOffset<typename T::LookupSubTable> (this, offset).sanitize (c, get_type ()));
+  }
+
   protected:
   union {
   USHORT		format;		/* Format identifier */
@@ -1799,7 +2119,7 @@ struct GSUBGPOS
   { return (this+lookupList)[i]; }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (version.sanitize (c) && likely (version.major == 1) &&
 			 scriptList.sanitize (c, this) &&
 			 featureList.sanitize (c, this) &&
@@ -1820,7 +2140,7 @@ struct GSUBGPOS
 };
 
 
-} // namespace OT
+} /* namespace OT */
 
 
 #endif /* HB_OT_LAYOUT_GSUBGPOS_PRIVATE_HH */
diff --git a/gfx/harfbuzz/src/hb-ot-layout-private.hh b/gfx/harfbuzz/src/hb-ot-layout-private.hh
index 055933f4db57..49093de8a1e0 100644
--- a/gfx/harfbuzz/src/hb-ot-layout-private.hh
+++ b/gfx/harfbuzz/src/hb-ot-layout-private.hh
@@ -49,6 +49,14 @@
  * GDEF
  */
 
+typedef enum {
+  HB_OT_LAYOUT_GLYPH_PROPS_UNCLASSIFIED	= 0x0001,
+  HB_OT_LAYOUT_GLYPH_PROPS_BASE_GLYPH	= 0x0002,
+  HB_OT_LAYOUT_GLYPH_PROPS_LIGATURE	= 0x0004,
+  HB_OT_LAYOUT_GLYPH_PROPS_MARK		= 0x0008,
+  HB_OT_LAYOUT_GLYPH_PROPS_COMPONENT	= 0x0010
+} hb_ot_layout_glyph_class_mask_t;
+
 
 
 /*
@@ -115,7 +123,7 @@ get_lig_comp (const hb_glyph_info_t &info)
 static inline unsigned int
 get_lig_num_comps (const hb_glyph_info_t &info)
 {
-  if ((info.glyph_props() & HB_OT_LAYOUT_GLYPH_CLASS_LIGATURE) && is_a_ligature (info))
+  if ((info.glyph_props() & HB_OT_LAYOUT_GLYPH_PROPS_LIGATURE) && is_a_ligature (info))
     return info.lig_props() & 0x0F;
   else
     return 1;
diff --git a/gfx/harfbuzz/src/hb-ot-layout.cc b/gfx/harfbuzz/src/hb-ot-layout.cc
index e57b765402af..5c266e61942c 100644
--- a/gfx/harfbuzz/src/hb-ot-layout.cc
+++ b/gfx/harfbuzz/src/hb-ot-layout.cc
@@ -33,7 +33,6 @@
 #include "hb-ot-layout-gdef-table.hh"
 #include "hb-ot-layout-gsub-table.hh"
 #include "hb-ot-layout-gpos-table.hh"
-#include "hb-ot-maxp-table.hh"
 
 #include <stdlib.h>
 #include <string.h>
@@ -71,9 +70,9 @@ _hb_ot_layout_create (hb_face_t *face)
   }
 
   for (unsigned int i = 0; i < layout->gsub_lookup_count; i++)
-    layout->gsub->add_coverage (&layout->gsub_digests[i], i);
+    layout->gsub->get_lookup (i).add_coverage (&layout->gsub_digests[i]);
   for (unsigned int i = 0; i < layout->gpos_lookup_count; i++)
-    layout->gpos->add_coverage (&layout->gpos_digests[i], i);
+    layout->gpos->get_lookup (i).add_coverage (&layout->gpos_digests[i]);
 
   return layout;
 }
@@ -121,6 +120,20 @@ hb_ot_layout_has_glyph_classes (hb_face_t *face)
   return _get_gdef (face).has_glyph_classes ();
 }
 
+hb_ot_layout_glyph_class_t
+hb_ot_layout_get_glyph_class (hb_face_t      *face,
+			      hb_codepoint_t  glyph)
+{
+  return (hb_ot_layout_glyph_class_t) _get_gdef (face).get_glyph_class (glyph);
+}
+
+void
+hb_ot_layout_get_glyphs_in_class (hb_face_t                  *face,
+				  hb_ot_layout_glyph_class_t  klass,
+				  hb_set_t                   *glyphs /* OUT */)
+{
+  return _get_gdef (face).get_glyphs_in_class (klass, glyphs);
+}
 
 unsigned int
 hb_ot_layout_get_attach_points (hb_face_t      *face,
@@ -387,6 +400,219 @@ hb_ot_layout_feature_get_lookups (hb_face_t    *face,
   return f.get_lookup_indexes (start_offset, lookup_count, lookup_indexes);
 }
 
+static void
+_hb_ot_layout_collect_lookups_lookups (hb_face_t      *face,
+				       hb_tag_t        table_tag,
+				       unsigned int    feature_index,
+				       hb_set_t       *lookup_indexes /* OUT */)
+{
+  unsigned int lookup_indices[32];
+  unsigned int offset, len;
+
+  offset = 0;
+  do {
+    len = ARRAY_LENGTH (lookup_indices);
+    hb_ot_layout_feature_get_lookups (face,
+				      table_tag,
+				      feature_index,
+				      offset, &len,
+				      lookup_indices);
+
+    for (unsigned int i = 0; i < len; i++)
+      lookup_indexes->add (lookup_indices[i]);
+
+    offset += len;
+  } while (len == ARRAY_LENGTH (lookup_indices));
+}
+
+static void
+_hb_ot_layout_collect_lookups_features (hb_face_t      *face,
+					hb_tag_t        table_tag,
+					unsigned int    script_index,
+					unsigned int    language_index,
+					const hb_tag_t *features,
+					hb_set_t       *lookup_indexes /* OUT */)
+{
+  unsigned int required_feature_index;
+  if (hb_ot_layout_language_get_required_feature_index (face,
+							table_tag,
+							script_index,
+							language_index,
+							&required_feature_index))
+    _hb_ot_layout_collect_lookups_lookups (face,
+					   table_tag,
+					   required_feature_index,
+					   lookup_indexes);
+
+  if (!features)
+  {
+    /* All features */
+    unsigned int feature_indices[32];
+    unsigned int offset, len;
+
+    offset = 0;
+    do {
+      len = ARRAY_LENGTH (feature_indices);
+      hb_ot_layout_language_get_feature_indexes (face,
+						 table_tag,
+						 script_index,
+						 language_index,
+						 offset, &len,
+						 feature_indices);
+
+      for (unsigned int i = 0; i < len; i++)
+	_hb_ot_layout_collect_lookups_lookups (face,
+					       table_tag,
+					       feature_indices[i],
+					       lookup_indexes);
+
+      offset += len;
+    } while (len == ARRAY_LENGTH (feature_indices));
+  }
+  else
+  {
+    for (; *features; features++)
+    {
+      unsigned int feature_index;
+      if (hb_ot_layout_language_find_feature (face,
+					      table_tag,
+					      script_index,
+					      language_index,
+					      *features,
+					      &feature_index))
+        _hb_ot_layout_collect_lookups_lookups (face,
+					       table_tag,
+					       feature_index,
+					       lookup_indexes);
+    }
+  }
+}
+
+static void
+_hb_ot_layout_collect_lookups_languages (hb_face_t      *face,
+					 hb_tag_t        table_tag,
+					 unsigned int    script_index,
+					 const hb_tag_t *languages,
+					 const hb_tag_t *features,
+					 hb_set_t       *lookup_indexes /* OUT */)
+{
+  _hb_ot_layout_collect_lookups_features (face,
+					  table_tag,
+					  script_index,
+					  HB_OT_LAYOUT_DEFAULT_LANGUAGE_INDEX,
+					  features,
+					  lookup_indexes);
+
+  if (!languages)
+  {
+    /* All languages */
+    unsigned int count = hb_ot_layout_script_get_language_tags (face,
+								table_tag,
+								script_index,
+								0, NULL, NULL);
+    for (unsigned int language_index = 0; language_index < count; language_index++)
+      _hb_ot_layout_collect_lookups_features (face,
+					      table_tag,
+					      script_index,
+					      language_index,
+					      features,
+					      lookup_indexes);
+  }
+  else
+  {
+    for (; *languages; languages++)
+    {
+      unsigned int language_index;
+      if (hb_ot_layout_script_find_language (face,
+					     table_tag,
+					     script_index,
+					     *languages,
+					     &language_index))
+        _hb_ot_layout_collect_lookups_features (face,
+						table_tag,
+						script_index,
+						language_index,
+						features,
+						lookup_indexes);
+    }
+  }
+}
+
+void
+hb_ot_layout_collect_lookups (hb_face_t      *face,
+			      hb_tag_t        table_tag,
+			      const hb_tag_t *scripts,
+			      const hb_tag_t *languages,
+			      const hb_tag_t *features,
+			      hb_set_t       *lookup_indexes /* OUT */)
+{
+  if (!scripts)
+  {
+    /* All scripts */
+    unsigned int count = hb_ot_layout_table_get_script_tags (face,
+							     table_tag,
+							     0, NULL, NULL);
+    for (unsigned int script_index = 0; script_index < count; script_index++)
+      _hb_ot_layout_collect_lookups_languages (face,
+					       table_tag,
+					       script_index,
+					       languages,
+					       features,
+					       lookup_indexes);
+  }
+  else
+  {
+    for (; *scripts; scripts++)
+    {
+      unsigned int script_index;
+      if (hb_ot_layout_table_find_script (face,
+					  table_tag,
+					  *scripts,
+					  &script_index))
+        _hb_ot_layout_collect_lookups_languages (face,
+						 table_tag,
+						 script_index,
+						 languages,
+						 features,
+						 lookup_indexes);
+    }
+  }
+}
+
+void
+hb_ot_layout_lookup_collect_glyphs (hb_face_t    *face,
+				    hb_tag_t      table_tag,
+				    unsigned int  lookup_index,
+				    hb_set_t     *glyphs_before, /* OUT. May be NULL */
+				    hb_set_t     *glyphs_input,  /* OUT. May be NULL */
+				    hb_set_t     *glyphs_after,  /* OUT. May be NULL */
+				    hb_set_t     *glyphs_output  /* OUT. May be NULL */)
+{
+  if (unlikely (!hb_ot_shaper_face_data_ensure (face))) return;
+
+  OT::hb_collect_glyphs_context_t c (face,
+				     glyphs_before,
+				     glyphs_input,
+				     glyphs_after,
+				     glyphs_output);
+
+  switch (table_tag)
+  {
+    case HB_OT_TAG_GSUB:
+    {
+      const OT::SubstLookup& l = hb_ot_layout_from_face (face)->gsub->get_lookup (lookup_index);
+      l.collect_glyphs_lookup (&c);
+      return;
+    }
+    case HB_OT_TAG_GPOS:
+    {
+      const OT::PosLookup& l = hb_ot_layout_from_face (face)->gpos->get_lookup (lookup_index);
+      l.collect_glyphs_lookup (&c);
+      return;
+    }
+  }
+}
+
 
 /*
  * OT::GSUB
@@ -457,7 +683,10 @@ hb_ot_layout_lookup_substitute_closure (hb_face_t    *face,
 				        hb_set_t     *glyphs)
 {
   OT::hb_closure_context_t c (face, glyphs);
-  _get_gsub (face).closure_lookup (&c, lookup_index);
+
+  const OT::SubstLookup& l = _get_gsub (face).get_lookup (lookup_index);
+
+  l.closure (&c);
 }
 
 /*
@@ -496,3 +725,48 @@ hb_ot_layout_position_finish (hb_font_t *font, hb_buffer_t *buffer, hb_bool_t ze
 {
   OT::GPOS::position_finish (font, buffer, zero_width_attached_marks);
 }
+
+hb_bool_t
+hb_ot_layout_get_size_params (hb_face_t    *face,
+			      unsigned int *design_size,       /* OUT.  May be NULL */
+			      unsigned int *subfamily_id,      /* OUT.  May be NULL */
+			      unsigned int *subfamily_name_id, /* OUT.  May be NULL */
+			      unsigned int *range_start,       /* OUT.  May be NULL */
+			      unsigned int *range_end          /* OUT.  May be NULL */)
+{
+  const OT::GPOS &gpos = _get_gpos (face);
+  const hb_tag_t tag = HB_TAG ('s','i','z','e');
+
+  unsigned int num_features = gpos.get_feature_count ();
+  for (unsigned int i = 0; i < num_features; i++)
+  {
+    if (tag == gpos.get_feature_tag (i))
+    {
+      const OT::Feature &f = gpos.get_feature (i);
+      const OT::FeatureParamsSize &params = f.get_feature_params ().get_size_params (tag);
+
+      if (params.designSize)
+      {
+#define PARAM(a, A) if (a) *a = params.A
+	PARAM (design_size, designSize);
+	PARAM (subfamily_id, subfamilyID);
+	PARAM (subfamily_name_id, subfamilyNameID);
+	PARAM (range_start, rangeStart);
+	PARAM (range_end, rangeEnd);
+#undef PARAM
+
+	return true;
+      }
+    }
+  }
+
+#define PARAM(a, A) if (a) *a = 0
+  PARAM (design_size, designSize);
+  PARAM (subfamily_id, subfamilyID);
+  PARAM (subfamily_name_id, subfamilyNameID);
+  PARAM (range_start, rangeStart);
+  PARAM (range_end, rangeEnd);
+#undef PARAM
+
+  return false;
+}
diff --git a/gfx/harfbuzz/src/hb-ot-layout.h b/gfx/harfbuzz/src/hb-ot-layout.h
index 7b53367886eb..134f1a6c1642 100644
--- a/gfx/harfbuzz/src/hb-ot-layout.h
+++ b/gfx/harfbuzz/src/hb-ot-layout.h
@@ -51,24 +51,21 @@ hb_bool_t
 hb_ot_layout_has_glyph_classes (hb_face_t *face);
 
 typedef enum {
-  HB_OT_LAYOUT_GLYPH_CLASS_UNCLASSIFIED	= 0x0001,
-  HB_OT_LAYOUT_GLYPH_CLASS_BASE_GLYPH	= 0x0002,
-  HB_OT_LAYOUT_GLYPH_CLASS_LIGATURE	= 0x0004,
-  HB_OT_LAYOUT_GLYPH_CLASS_MARK		= 0x0008,
-  HB_OT_LAYOUT_GLYPH_CLASS_COMPONENT	= 0x0010
+  HB_OT_LAYOUT_GLYPH_CLASS_UNCLASSIFIED	= 0,
+  HB_OT_LAYOUT_GLYPH_CLASS_BASE_GLYPH	= 1,
+  HB_OT_LAYOUT_GLYPH_CLASS_LIGATURE	= 2,
+  HB_OT_LAYOUT_GLYPH_CLASS_MARK		= 3,
+  HB_OT_LAYOUT_GLYPH_CLASS_COMPONENT	= 4
 } hb_ot_layout_glyph_class_t;
 
-#ifdef HB_NOT_IMPLEMENTED
 hb_ot_layout_glyph_class_t
-Xhb_ot_layout_get_glyph_class (hb_face_t      *face,
+hb_ot_layout_get_glyph_class (hb_face_t      *face,
 			      hb_codepoint_t  glyph);
-#endif
 
-#ifdef HB_NOT_IMPLEMENTED
-Xhb_ot_layout_get_glyphs_in_class (hb_face_t                  *face,
+void
+hb_ot_layout_get_glyphs_in_class (hb_face_t                  *face,
 				  hb_ot_layout_glyph_class_t  klass,
 				  hb_set_t                   *glyphs /* OUT */);
-#endif
 
 
 /* Not that useful.  Provides list of attach points for a glyph that a
@@ -182,31 +179,27 @@ hb_ot_layout_feature_get_lookups (hb_face_t    *face,
 				  unsigned int *lookup_count /* IN/OUT */,
 				  unsigned int *lookup_indexes /* OUT */);
 
-#ifdef HB_NOT_IMPLEMENTED
 void
-Xhb_ot_layout_collect_lookups (hb_face_t      *face,
+hb_ot_layout_collect_lookups (hb_face_t      *face,
 			      hb_tag_t        table_tag,
 			      const hb_tag_t *scripts,
 			      const hb_tag_t *languages,
 			      const hb_tag_t *features,
 			      hb_set_t       *lookup_indexes /* OUT */);
-#endif
 
 void
 hb_ot_shape_plan_collect_lookups (hb_shape_plan_t *shape_plan,
 				  hb_tag_t         table_tag,
 				  hb_set_t        *lookup_indexes /* OUT */);
 
-#ifdef HB_NOT_IMPLEMENTED
 void
-Xhb_ot_layout_lookup_collect_glyphs (hb_face_t    *face,
+hb_ot_layout_lookup_collect_glyphs (hb_face_t    *face,
 				    hb_tag_t      table_tag,
 				    unsigned int  lookup_index,
 				    hb_set_t     *glyphs_before, /* OUT. May be NULL */
 				    hb_set_t     *glyphs_input,  /* OUT. May be NULL */
 				    hb_set_t     *glyphs_after,  /* OUT. May be NULL */
 				    hb_set_t     *glyphs_output  /* OUT. May be NULL */);
-#endif
 
 #ifdef HB_NOT_IMPLEMENTED
 typedef struct
@@ -284,6 +277,16 @@ Xhb_ot_layout_lookup_position (hb_font_t            *font,
 			      hb_glyph_position_t  *positions /* IN / OUT */);
 #endif
 
+/* Optical 'size' feature info.  Returns true if found.
+ * http://www.microsoft.com/typography/otspec/features_pt.htm#size */
+hb_bool_t
+hb_ot_layout_get_size_params (hb_face_t    *face,
+			      unsigned int *design_size,       /* OUT.  May be NULL */
+			      unsigned int *subfamily_id,      /* OUT.  May be NULL */
+			      unsigned int *subfamily_name_id, /* OUT.  May be NULL */
+			      unsigned int *range_start,       /* OUT.  May be NULL */
+			      unsigned int *range_end          /* OUT.  May be NULL */);
+
 
 HB_END_DECLS
 
diff --git a/gfx/harfbuzz/src/hb-ot-maxp-table.hh b/gfx/harfbuzz/src/hb-ot-maxp-table.hh
index 9e113c73ad6a..0ce3ebcc2a65 100644
--- a/gfx/harfbuzz/src/hb-ot-maxp-table.hh
+++ b/gfx/harfbuzz/src/hb-ot-maxp-table.hh
@@ -48,7 +48,7 @@ struct maxp
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this) &&
 			 likely (version.major == 1 || (version.major == 0 && version.minor == 0x5000)));
   }
@@ -63,7 +63,7 @@ struct maxp
 };
 
 
-} // namespace OT
+} /* namespace OT */
 
 
 #endif /* HB_OT_MAXP_TABLE_HH */
diff --git a/gfx/harfbuzz/src/hb-ot-name-table.hh b/gfx/harfbuzz/src/hb-ot-name-table.hh
index 6cc7a5ea2fd3..75a1b94ea312 100644
--- a/gfx/harfbuzz/src/hb-ot-name-table.hh
+++ b/gfx/harfbuzz/src/hb-ot-name-table.hh
@@ -57,7 +57,7 @@ struct NameRecord
   }
 
   inline bool sanitize (hb_sanitize_context_t *c, void *base) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     /* We can check from base all the way up to the end of string... */
     return TRACE_RETURN (c->check_struct (this) && c->check_range ((char *) base, (unsigned int) length + offset));
   }
@@ -99,7 +99,7 @@ struct name
   }
 
   inline bool sanitize_records (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     char *string_pool = (char *) this + stringOffset;
     unsigned int _count = count;
     for (unsigned int i = 0; i < _count; i++)
@@ -108,7 +108,7 @@ struct name
   }
 
   inline bool sanitize (hb_sanitize_context_t *c) {
-    TRACE_SANITIZE ();
+    TRACE_SANITIZE (this);
     return TRACE_RETURN (c->check_struct (this) &&
 			 likely (format == 0 || format == 1) &&
 			 c->check_array (nameRecord, nameRecord[0].static_size, count) &&
@@ -126,7 +126,7 @@ struct name
 };
 
 
-} // namespace OT
+} /* namespace OT */
 
 
 #endif /* HB_OT_NAME_TABLE_HH */
diff --git a/gfx/harfbuzz/src/hb-ot-shape-complex-arabic-fallback.hh b/gfx/harfbuzz/src/hb-ot-shape-complex-arabic-fallback.hh
index bf68561e1619..4fcd0a2fd94e 100644
--- a/gfx/harfbuzz/src/hb-ot-shape-complex-arabic-fallback.hh
+++ b/gfx/harfbuzz/src/hb-ot-shape-complex-arabic-fallback.hh
@@ -53,7 +53,7 @@ enum {
 };
 
 static OT::SubstLookup *
-arabic_fallback_synthesize_lookup_single (const hb_ot_shape_plan_t *plan,
+arabic_fallback_synthesize_lookup_single (const hb_ot_shape_plan_t *plan HB_UNUSED,
 					  hb_font_t *font,
 					  unsigned int feature_index)
 {
@@ -103,7 +103,7 @@ arabic_fallback_synthesize_lookup_single (const hb_ot_shape_plan_t *plan,
 }
 
 static OT::SubstLookup *
-arabic_fallback_synthesize_lookup_ligature (const hb_ot_shape_plan_t *plan,
+arabic_fallback_synthesize_lookup_ligature (const hb_ot_shape_plan_t *plan HB_UNUSED,
 					    hb_font_t *font)
 {
   OT::GlyphID first_glyphs[ARRAY_LENGTH_CONST (ligature_table)];
diff --git a/gfx/harfbuzz/src/hb-ot-shape-complex-arabic-table.hh b/gfx/harfbuzz/src/hb-ot-shape-complex-arabic-table.hh
index 5e29167ad742..730a275bf0ac 100644
--- a/gfx/harfbuzz/src/hb-ot-shape-complex-arabic-table.hh
+++ b/gfx/harfbuzz/src/hb-ot-shape-complex-arabic-table.hh
@@ -6,8 +6,8 @@
  *
  * on files with these headers:
  *
- * # ArabicShaping-6.1.0.txt
- * # Date: 2011-04-15, 23:16:00 GMT [KW]
+ * # ArabicShaping-6.2.0.txt
+ * # Date: 2012-05-15, 21:05:00 GMT [KW]
  * UnicodeData.txt does not have a header.
  */
 
diff --git a/gfx/harfbuzz/src/hb-ot-shape-complex-arabic.cc b/gfx/harfbuzz/src/hb-ot-shape-complex-arabic.cc
index e9db005455fb..35356fe97d3c 100644
--- a/gfx/harfbuzz/src/hb-ot-shape-complex-arabic.cc
+++ b/gfx/harfbuzz/src/hb-ot-shape-complex-arabic.cc
@@ -305,7 +305,7 @@ arabic_joining (hb_buffer_t *buffer)
 static void
 setup_masks_arabic (const hb_ot_shape_plan_t *plan,
 		    hb_buffer_t              *buffer,
-		    hb_font_t                *font)
+		    hb_font_t                *font HB_UNUSED)
 {
   const arabic_shape_plan_t *arabic_plan = (const arabic_shape_plan_t *) plan->data;
 
diff --git a/gfx/harfbuzz/src/hb-ot-shape-complex-default.cc b/gfx/harfbuzz/src/hb-ot-shape-complex-default.cc
index 6a17330215fc..5340293db505 100644
--- a/gfx/harfbuzz/src/hb-ot-shape-complex-default.cc
+++ b/gfx/harfbuzz/src/hb-ot-shape-complex-default.cc
@@ -90,114 +90,115 @@ compose_default (const hb_ot_shape_normalize_context_t *c,
 		 hb_codepoint_t *ab)
 {
   /* Hebrew presentation-form shaping.
-   * https://bugzilla.mozilla.org/show_bug.cgi?id=728866 */
-  // Hebrew presentation forms with dagesh, for characters 0x05D0..0x05EA;
-  // note that some letters do not have a dagesh presForm encoded
+   * https://bugzilla.mozilla.org/show_bug.cgi?id=728866
+   * Hebrew presentation forms with dagesh, for characters 0x05D0..0x05EA;
+   * Note that some letters do not have a dagesh presForm encoded.
+   */
   static const hb_codepoint_t sDageshForms[0x05EA - 0x05D0 + 1] = {
-    0xFB30, // ALEF
-    0xFB31, // BET
-    0xFB32, // GIMEL
-    0xFB33, // DALET
-    0xFB34, // HE
-    0xFB35, // VAV
-    0xFB36, // ZAYIN
-    0, // HET
-    0xFB38, // TET
-    0xFB39, // YOD
-    0xFB3A, // FINAL KAF
-    0xFB3B, // KAF
-    0xFB3C, // LAMED
-    0, // FINAL MEM
-    0xFB3E, // MEM
-    0, // FINAL NUN
-    0xFB40, // NUN
-    0xFB41, // SAMEKH
-    0, // AYIN
-    0xFB43, // FINAL PE
-    0xFB44, // PE
-    0, // FINAL TSADI
-    0xFB46, // TSADI
-    0xFB47, // QOF
-    0xFB48, // RESH
-    0xFB49, // SHIN
-    0xFB4A // TAV
+    0xFB30, /* ALEF */
+    0xFB31, /* BET */
+    0xFB32, /* GIMEL */
+    0xFB33, /* DALET */
+    0xFB34, /* HE */
+    0xFB35, /* VAV */
+    0xFB36, /* ZAYIN */
+    0x0000, /* HET */
+    0xFB38, /* TET */
+    0xFB39, /* YOD */
+    0xFB3A, /* FINAL KAF */
+    0xFB3B, /* KAF */
+    0xFB3C, /* LAMED */
+    0x0000, /* FINAL MEM */
+    0xFB3E, /* MEM */
+    0x0000, /* FINAL NUN */
+    0xFB40, /* NUN */
+    0xFB41, /* SAMEKH */
+    0x0000, /* AYIN */
+    0xFB43, /* FINAL PE */
+    0xFB44, /* PE */
+    0x0000, /* FINAL TSADI */
+    0xFB46, /* TSADI */
+    0xFB47, /* QOF */
+    0xFB48, /* RESH */
+    0xFB49, /* SHIN */
+    0xFB4A /* TAV */
   };
 
   bool found = c->unicode->compose (a, b, ab);
 
   if (!found && (b & ~0x7F) == 0x0580) {
-      // special-case Hebrew presentation forms that are excluded from
-      // standard normalization, but wanted for old fonts
+      /* Special-case Hebrew presentation forms that are excluded from
+       * standard normalization, but wanted for old fonts. */
       switch (b) {
-      case 0x05B4: // HIRIQ
-	  if (a == 0x05D9) { // YOD
+      case 0x05B4: /* HIRIQ */
+	  if (a == 0x05D9) { /* YOD */
 	      *ab = 0xFB1D;
 	      found = true;
 	  }
 	  break;
-      case 0x05B7: // patah
-	  if (a == 0x05F2) { // YIDDISH YOD YOD
+      case 0x05B7: /* patah */
+	  if (a == 0x05F2) { /* YIDDISH YOD YOD */
 	      *ab = 0xFB1F;
 	      found = true;
-	  } else if (a == 0x05D0) { // ALEF
+	  } else if (a == 0x05D0) { /* ALEF */
 	      *ab = 0xFB2E;
 	      found = true;
 	  }
 	  break;
-      case 0x05B8: // QAMATS
-	  if (a == 0x05D0) { // ALEF
+      case 0x05B8: /* QAMATS */
+	  if (a == 0x05D0) { /* ALEF */
 	      *ab = 0xFB2F;
 	      found = true;
 	  }
 	  break;
-      case 0x05B9: // HOLAM
-	  if (a == 0x05D5) { // VAV
+      case 0x05B9: /* HOLAM */
+	  if (a == 0x05D5) { /* VAV */
 	      *ab = 0xFB4B;
 	      found = true;
 	  }
 	  break;
-      case 0x05BC: // DAGESH
+      case 0x05BC: /* DAGESH */
 	  if (a >= 0x05D0 && a <= 0x05EA) {
 	      *ab = sDageshForms[a - 0x05D0];
 	      found = (*ab != 0);
-	  } else if (a == 0xFB2A) { // SHIN WITH SHIN DOT
+	  } else if (a == 0xFB2A) { /* SHIN WITH SHIN DOT */
 	      *ab = 0xFB2C;
 	      found = true;
-	  } else if (a == 0xFB2B) { // SHIN WITH SIN DOT
+	  } else if (a == 0xFB2B) { /* SHIN WITH SIN DOT */
 	      *ab = 0xFB2D;
 	      found = true;
 	  }
 	  break;
-      case 0x05BF: // RAFE
+      case 0x05BF: /* RAFE */
 	  switch (a) {
-	  case 0x05D1: // BET
+	  case 0x05D1: /* BET */
 	      *ab = 0xFB4C;
 	      found = true;
 	      break;
-	  case 0x05DB: // KAF
+	  case 0x05DB: /* KAF */
 	      *ab = 0xFB4D;
 	      found = true;
 	      break;
-	  case 0x05E4: // PE
+	  case 0x05E4: /* PE */
 	      *ab = 0xFB4E;
 	      found = true;
 	      break;
 	  }
 	  break;
-      case 0x05C1: // SHIN DOT
-	  if (a == 0x05E9) { // SHIN
+      case 0x05C1: /* SHIN DOT */
+	  if (a == 0x05E9) { /* SHIN */
 	      *ab = 0xFB2A;
 	      found = true;
-	  } else if (a == 0xFB49) { // SHIN WITH DAGESH
+	  } else if (a == 0xFB49) { /* SHIN WITH DAGESH */
 	      *ab = 0xFB2C;
 	      found = true;
 	  }
 	  break;
-      case 0x05C2: // SIN DOT
-	  if (a == 0x05E9) { // SHIN
+      case 0x05C2: /* SIN DOT */
+	  if (a == 0x05E9) { /* SHIN */
 	      *ab = 0xFB2B;
 	      found = true;
-	  } else if (a == 0xFB49) { // SHIN WITH DAGESH
+	  } else if (a == 0xFB49) { /* SHIN WITH DAGESH */
 	      *ab = 0xFB2D;
 	      found = true;
 	  }
diff --git a/gfx/harfbuzz/src/hb-ot-shape-complex-indic-machine.hh b/gfx/harfbuzz/src/hb-ot-shape-complex-indic-machine.hh
index 1c0e7f224c1f..ed40b968bcb9 100644
--- a/gfx/harfbuzz/src/hb-ot-shape-complex-indic-machine.hh
+++ b/gfx/harfbuzz/src/hb-ot-shape-complex-indic-machine.hh
@@ -51,35 +51,29 @@ static const unsigned char _indic_syllable_machine_trans_keys[] = {
 	5u, 7u, 5u, 7u, 7u, 7u, 5u, 7u, 5u, 7u, 7u, 7u, 5u, 7u, 5u, 7u, 
 	7u, 7u, 4u, 4u, 6u, 6u, 16u, 16u, 4u, 7u, 6u, 6u, 16u, 16u, 4u, 7u, 
 	6u, 6u, 16u, 16u, 4u, 7u, 6u, 6u, 16u, 16u, 4u, 14u, 4u, 14u, 4u, 14u, 
-	4u, 14u, 4u, 14u, 4u, 14u, 4u, 14u, 4u, 14u, 4u, 14u, 4u, 14u, 1u, 16u, 
-	3u, 17u, 3u, 14u, 4u, 14u, 1u, 16u, 3u, 17u, 3u, 14u, 4u, 14u, 1u, 16u, 
-	3u, 17u, 3u, 14u, 4u, 14u, 1u, 16u, 3u, 17u, 3u, 14u, 4u, 14u, 1u, 16u, 
-	3u, 17u, 3u, 14u, 4u, 14u, 5u, 14u, 8u, 14u, 5u, 9u, 9u, 9u, 9u, 9u, 
-	3u, 17u, 3u, 9u, 8u, 9u, 3u, 9u, 3u, 13u, 3u, 14u, 3u, 14u, 4u, 14u, 
-	5u, 14u, 3u, 14u, 4u, 14u, 5u, 14u, 3u, 14u, 4u, 14u, 5u, 14u, 3u, 14u, 
-	4u, 14u, 6u, 14u, 3u, 14u, 4u, 14u, 1u, 16u, 3u, 14u, 3u, 14u, 1u, 16u, 
-	1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 3u, 14u, 3u, 14u, 1u, 16u, 1u, 16u, 
-	1u, 16u, 1u, 16u, 1u, 16u, 3u, 14u, 3u, 14u, 1u, 16u, 1u, 16u, 1u, 16u, 
-	1u, 16u, 1u, 16u, 3u, 14u, 3u, 14u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 
-	1u, 16u, 3u, 14u, 3u, 14u, 3u, 14u, 3u, 14u, 4u, 14u, 1u, 16u, 3u, 17u, 
+	4u, 14u, 4u, 14u, 4u, 14u, 4u, 14u, 4u, 14u, 4u, 14u, 4u, 14u, 4u, 14u, 
+	4u, 14u, 5u, 7u, 5u, 7u, 5u, 7u, 5u, 7u, 7u, 7u, 5u, 7u, 5u, 7u, 
+	7u, 7u, 5u, 7u, 5u, 7u, 7u, 7u, 1u, 16u, 13u, 13u, 4u, 4u, 6u, 6u, 
+	16u, 16u, 4u, 7u, 6u, 6u, 16u, 16u, 4u, 7u, 6u, 6u, 16u, 16u, 4u, 7u, 
+	6u, 6u, 16u, 16u, 1u, 16u, 3u, 17u, 3u, 14u, 4u, 14u, 1u, 16u, 3u, 17u, 
 	3u, 14u, 4u, 14u, 1u, 16u, 3u, 17u, 3u, 14u, 4u, 14u, 1u, 16u, 3u, 17u, 
 	3u, 14u, 4u, 14u, 1u, 16u, 3u, 17u, 3u, 14u, 4u, 14u, 5u, 14u, 8u, 14u, 
 	5u, 9u, 9u, 9u, 9u, 9u, 3u, 17u, 3u, 9u, 8u, 9u, 3u, 9u, 3u, 13u, 
 	3u, 14u, 3u, 14u, 4u, 14u, 5u, 14u, 3u, 14u, 4u, 14u, 5u, 14u, 3u, 14u, 
-	4u, 14u, 5u, 14u, 3u, 14u, 4u, 14u, 6u, 14u, 3u, 14u, 1u, 16u, 3u, 14u, 
-	3u, 14u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 3u, 14u, 3u, 14u, 
-	1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 3u, 14u, 3u, 14u, 1u, 16u, 
-	1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 3u, 14u, 3u, 14u, 1u, 16u, 1u, 16u, 
-	1u, 16u, 1u, 16u, 4u, 14u, 1u, 16u, 3u, 14u, 3u, 14u, 4u, 14u, 1u, 16u, 
-	3u, 17u, 3u, 14u, 4u, 14u, 1u, 16u, 3u, 17u, 3u, 14u, 4u, 14u, 1u, 16u, 
-	3u, 17u, 3u, 14u, 4u, 14u, 1u, 16u, 3u, 17u, 3u, 14u, 4u, 14u, 5u, 14u, 
-	8u, 14u, 5u, 9u, 9u, 9u, 9u, 9u, 3u, 17u, 3u, 9u, 8u, 9u, 3u, 9u, 
-	3u, 13u, 3u, 14u, 3u, 14u, 4u, 14u, 5u, 14u, 3u, 14u, 4u, 14u, 5u, 14u, 
-	3u, 14u, 4u, 14u, 5u, 14u, 3u, 14u, 4u, 14u, 6u, 14u, 3u, 14u, 1u, 16u, 
+	4u, 14u, 5u, 14u, 3u, 14u, 4u, 14u, 6u, 14u, 3u, 14u, 4u, 14u, 1u, 16u, 
 	3u, 14u, 3u, 14u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 3u, 14u, 
 	3u, 14u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 3u, 14u, 3u, 14u, 
 	1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 3u, 14u, 3u, 14u, 1u, 16u, 
-	1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 4u, 14u, 3u, 14u, 4u, 14u, 3u, 14u, 
+	1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 3u, 14u, 3u, 14u, 3u, 14u, 3u, 14u, 
+	4u, 14u, 1u, 16u, 3u, 17u, 3u, 14u, 4u, 14u, 1u, 16u, 3u, 17u, 3u, 14u, 
+	4u, 14u, 1u, 16u, 3u, 17u, 3u, 14u, 4u, 14u, 1u, 16u, 3u, 17u, 3u, 14u, 
+	4u, 14u, 5u, 14u, 8u, 14u, 5u, 9u, 9u, 9u, 9u, 9u, 3u, 17u, 3u, 9u, 
+	8u, 9u, 3u, 9u, 3u, 13u, 3u, 14u, 3u, 14u, 4u, 14u, 5u, 14u, 3u, 14u, 
+	4u, 14u, 5u, 14u, 3u, 14u, 4u, 14u, 5u, 14u, 3u, 14u, 4u, 14u, 6u, 14u, 
+	3u, 14u, 1u, 16u, 3u, 14u, 3u, 14u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 
+	1u, 16u, 3u, 14u, 3u, 14u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 
+	3u, 14u, 3u, 14u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 3u, 14u, 
+	3u, 14u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 4u, 14u, 1u, 16u, 3u, 14u, 
 	3u, 14u, 4u, 14u, 1u, 16u, 3u, 17u, 3u, 14u, 4u, 14u, 1u, 16u, 3u, 17u, 
 	3u, 14u, 4u, 14u, 1u, 16u, 3u, 17u, 3u, 14u, 4u, 14u, 1u, 16u, 3u, 17u, 
 	3u, 14u, 4u, 14u, 5u, 14u, 8u, 14u, 5u, 9u, 9u, 9u, 9u, 9u, 3u, 17u, 
@@ -88,8 +82,21 @@ static const unsigned char _indic_syllable_machine_trans_keys[] = {
 	6u, 14u, 3u, 14u, 1u, 16u, 3u, 14u, 3u, 14u, 1u, 16u, 1u, 16u, 1u, 16u, 
 	1u, 16u, 1u, 16u, 3u, 14u, 3u, 14u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 
 	1u, 16u, 3u, 14u, 3u, 14u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 
-	3u, 14u, 3u, 14u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 3u, 14u, 
-	1u, 16u, 3u, 17u, 1u, 16u, 0
+	3u, 14u, 3u, 14u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 4u, 14u, 
+	3u, 14u, 4u, 14u, 3u, 14u, 3u, 14u, 4u, 14u, 1u, 16u, 3u, 17u, 3u, 14u, 
+	4u, 14u, 1u, 16u, 3u, 17u, 3u, 14u, 4u, 14u, 1u, 16u, 3u, 17u, 3u, 14u, 
+	4u, 14u, 1u, 16u, 3u, 17u, 3u, 14u, 4u, 14u, 5u, 14u, 8u, 14u, 5u, 9u, 
+	9u, 9u, 9u, 9u, 3u, 17u, 3u, 9u, 8u, 9u, 3u, 9u, 3u, 13u, 3u, 14u, 
+	3u, 14u, 4u, 14u, 5u, 14u, 3u, 14u, 4u, 14u, 5u, 14u, 3u, 14u, 4u, 14u, 
+	5u, 14u, 3u, 14u, 4u, 14u, 6u, 14u, 3u, 14u, 1u, 16u, 3u, 14u, 3u, 14u, 
+	1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 3u, 14u, 3u, 14u, 1u, 16u, 
+	1u, 16u, 1u, 16u, 1u, 16u, 1u, 16u, 3u, 14u, 3u, 14u, 1u, 16u, 1u, 16u, 
+	1u, 16u, 1u, 16u, 1u, 16u, 3u, 14u, 3u, 14u, 1u, 16u, 1u, 16u, 1u, 16u, 
+	1u, 16u, 1u, 16u, 3u, 14u, 1u, 16u, 3u, 17u, 1u, 16u, 4u, 14u, 1u, 16u, 
+	3u, 17u, 3u, 14u, 4u, 14u, 5u, 9u, 9u, 9u, 9u, 9u, 3u, 14u, 3u, 14u, 
+	1u, 16u, 3u, 14u, 4u, 14u, 5u, 14u, 3u, 14u, 4u, 14u, 5u, 14u, 3u, 14u, 
+	4u, 14u, 5u, 14u, 3u, 14u, 4u, 14u, 8u, 14u, 3u, 17u, 3u, 9u, 8u, 9u, 
+	3u, 9u, 3u, 13u, 1u, 16u, 0
 };
 
 static const char _indic_syllable_machine_key_spans[] = {
@@ -110,35 +117,29 @@ static const char _indic_syllable_machine_key_spans[] = {
 	3, 3, 1, 3, 3, 1, 3, 3, 
 	1, 1, 1, 1, 4, 1, 1, 4, 
 	1, 1, 4, 1, 1, 11, 11, 11, 
-	11, 11, 11, 11, 11, 11, 11, 16, 
-	15, 12, 11, 16, 15, 12, 11, 16, 
-	15, 12, 11, 16, 15, 12, 11, 16, 
-	15, 12, 11, 10, 7, 5, 1, 1, 
-	15, 7, 2, 7, 11, 12, 12, 11, 
-	10, 12, 11, 10, 12, 11, 10, 12, 
-	11, 9, 12, 11, 16, 12, 12, 16, 
-	16, 16, 16, 16, 12, 12, 16, 16, 
-	16, 16, 16, 12, 12, 16, 16, 16, 
-	16, 16, 12, 12, 16, 16, 16, 16, 
-	16, 12, 12, 12, 12, 11, 16, 15, 
+	11, 11, 11, 11, 11, 11, 11, 11, 
+	11, 3, 3, 3, 3, 1, 3, 3, 
+	1, 3, 3, 1, 16, 1, 1, 1, 
+	1, 4, 1, 1, 4, 1, 1, 4, 
+	1, 1, 16, 15, 12, 11, 16, 15, 
 	12, 11, 16, 15, 12, 11, 16, 15, 
 	12, 11, 16, 15, 12, 11, 10, 7, 
 	5, 1, 1, 15, 7, 2, 7, 11, 
 	12, 12, 11, 10, 12, 11, 10, 12, 
-	11, 10, 12, 11, 9, 12, 16, 12, 
-	12, 16, 16, 16, 16, 16, 12, 12, 
-	16, 16, 16, 16, 16, 12, 12, 16, 
-	16, 16, 16, 16, 12, 12, 16, 16, 
-	16, 16, 11, 16, 12, 12, 11, 16, 
-	15, 12, 11, 16, 15, 12, 11, 16, 
-	15, 12, 11, 16, 15, 12, 11, 10, 
-	7, 5, 1, 1, 15, 7, 2, 7, 
-	11, 12, 12, 11, 10, 12, 11, 10, 
-	12, 11, 10, 12, 11, 9, 12, 16, 
+	11, 10, 12, 11, 9, 12, 11, 16, 
 	12, 12, 16, 16, 16, 16, 16, 12, 
 	12, 16, 16, 16, 16, 16, 12, 12, 
 	16, 16, 16, 16, 16, 12, 12, 16, 
-	16, 16, 16, 16, 11, 12, 11, 12, 
+	16, 16, 16, 16, 12, 12, 12, 12, 
+	11, 16, 15, 12, 11, 16, 15, 12, 
+	11, 16, 15, 12, 11, 16, 15, 12, 
+	11, 10, 7, 5, 1, 1, 15, 7, 
+	2, 7, 11, 12, 12, 11, 10, 12, 
+	11, 10, 12, 11, 10, 12, 11, 9, 
+	12, 16, 12, 12, 16, 16, 16, 16, 
+	16, 12, 12, 16, 16, 16, 16, 16, 
+	12, 12, 16, 16, 16, 16, 16, 12, 
+	12, 16, 16, 16, 16, 11, 16, 12, 
 	12, 11, 16, 15, 12, 11, 16, 15, 
 	12, 11, 16, 15, 12, 11, 16, 15, 
 	12, 11, 10, 7, 5, 1, 1, 15, 
@@ -147,8 +148,21 @@ static const char _indic_syllable_machine_key_spans[] = {
 	9, 12, 16, 12, 12, 16, 16, 16, 
 	16, 16, 12, 12, 16, 16, 16, 16, 
 	16, 12, 12, 16, 16, 16, 16, 16, 
-	12, 12, 16, 16, 16, 16, 16, 12, 
-	16, 15, 16
+	12, 12, 16, 16, 16, 16, 16, 11, 
+	12, 11, 12, 12, 11, 16, 15, 12, 
+	11, 16, 15, 12, 11, 16, 15, 12, 
+	11, 16, 15, 12, 11, 10, 7, 5, 
+	1, 1, 15, 7, 2, 7, 11, 12, 
+	12, 11, 10, 12, 11, 10, 12, 11, 
+	10, 12, 11, 9, 12, 16, 12, 12, 
+	16, 16, 16, 16, 16, 12, 12, 16, 
+	16, 16, 16, 16, 12, 12, 16, 16, 
+	16, 16, 16, 12, 12, 16, 16, 16, 
+	16, 16, 12, 16, 15, 16, 11, 16, 
+	15, 12, 11, 5, 1, 1, 12, 12, 
+	16, 12, 11, 10, 12, 11, 10, 12, 
+	11, 10, 12, 11, 7, 15, 7, 2, 
+	7, 11, 16
 };
 
 static const short _indic_syllable_machine_index_offsets[] = {
@@ -170,44 +184,51 @@ static const short _indic_syllable_machine_index_offsets[] = {
 	681, 683, 685, 687, 689, 694, 696, 698, 
 	703, 705, 707, 712, 714, 716, 728, 740, 
 	752, 764, 776, 788, 800, 812, 824, 836, 
-	853, 869, 882, 894, 911, 927, 940, 952, 
-	969, 985, 998, 1010, 1027, 1043, 1056, 1068, 
-	1085, 1101, 1114, 1126, 1137, 1145, 1151, 1153, 
-	1155, 1171, 1179, 1182, 1190, 1202, 1215, 1228, 
-	1240, 1251, 1264, 1276, 1287, 1300, 1312, 1323, 
-	1336, 1348, 1358, 1371, 1383, 1400, 1413, 1426, 
-	1443, 1460, 1477, 1494, 1511, 1524, 1537, 1554, 
-	1571, 1588, 1605, 1622, 1635, 1648, 1665, 1682, 
-	1699, 1716, 1733, 1746, 1759, 1776, 1793, 1810, 
-	1827, 1844, 1857, 1870, 1883, 1896, 1908, 1925, 
-	1941, 1954, 1966, 1983, 1999, 2012, 2024, 2041, 
-	2057, 2070, 2082, 2099, 2115, 2128, 2140, 2151, 
-	2159, 2165, 2167, 2169, 2185, 2193, 2196, 2204, 
-	2216, 2229, 2242, 2254, 2265, 2278, 2290, 2301, 
-	2314, 2326, 2337, 2350, 2362, 2372, 2385, 2402, 
-	2415, 2428, 2445, 2462, 2479, 2496, 2513, 2526, 
-	2539, 2556, 2573, 2590, 2607, 2624, 2637, 2650, 
-	2667, 2684, 2701, 2718, 2735, 2748, 2761, 2778, 
-	2795, 2812, 2829, 2841, 2858, 2871, 2884, 2896, 
-	2913, 2929, 2942, 2954, 2971, 2987, 3000, 3012, 
-	3029, 3045, 3058, 3070, 3087, 3103, 3116, 3128, 
-	3139, 3147, 3153, 3155, 3157, 3173, 3181, 3184, 
-	3192, 3204, 3217, 3230, 3242, 3253, 3266, 3278, 
-	3289, 3302, 3314, 3325, 3338, 3350, 3360, 3373, 
-	3390, 3403, 3416, 3433, 3450, 3467, 3484, 3501, 
-	3514, 3527, 3544, 3561, 3578, 3595, 3612, 3625, 
-	3638, 3655, 3672, 3689, 3706, 3723, 3736, 3749, 
-	3766, 3783, 3800, 3817, 3834, 3846, 3859, 3871, 
-	3884, 3897, 3909, 3926, 3942, 3955, 3967, 3984, 
-	4000, 4013, 4025, 4042, 4058, 4071, 4083, 4100, 
-	4116, 4129, 4141, 4152, 4160, 4166, 4168, 4170, 
-	4186, 4194, 4197, 4205, 4217, 4230, 4243, 4255, 
-	4266, 4279, 4291, 4302, 4315, 4327, 4338, 4351, 
-	4363, 4373, 4386, 4403, 4416, 4429, 4446, 4463, 
-	4480, 4497, 4514, 4527, 4540, 4557, 4574, 4591, 
-	4608, 4625, 4638, 4651, 4668, 4685, 4702, 4719, 
-	4736, 4749, 4762, 4779, 4796, 4813, 4830, 4847, 
-	4860, 4877, 4893
+	848, 860, 864, 868, 872, 876, 878, 882, 
+	886, 888, 892, 896, 898, 915, 917, 919, 
+	921, 923, 928, 930, 932, 937, 939, 941, 
+	946, 948, 950, 967, 983, 996, 1008, 1025, 
+	1041, 1054, 1066, 1083, 1099, 1112, 1124, 1141, 
+	1157, 1170, 1182, 1199, 1215, 1228, 1240, 1251, 
+	1259, 1265, 1267, 1269, 1285, 1293, 1296, 1304, 
+	1316, 1329, 1342, 1354, 1365, 1378, 1390, 1401, 
+	1414, 1426, 1437, 1450, 1462, 1472, 1485, 1497, 
+	1514, 1527, 1540, 1557, 1574, 1591, 1608, 1625, 
+	1638, 1651, 1668, 1685, 1702, 1719, 1736, 1749, 
+	1762, 1779, 1796, 1813, 1830, 1847, 1860, 1873, 
+	1890, 1907, 1924, 1941, 1958, 1971, 1984, 1997, 
+	2010, 2022, 2039, 2055, 2068, 2080, 2097, 2113, 
+	2126, 2138, 2155, 2171, 2184, 2196, 2213, 2229, 
+	2242, 2254, 2265, 2273, 2279, 2281, 2283, 2299, 
+	2307, 2310, 2318, 2330, 2343, 2356, 2368, 2379, 
+	2392, 2404, 2415, 2428, 2440, 2451, 2464, 2476, 
+	2486, 2499, 2516, 2529, 2542, 2559, 2576, 2593, 
+	2610, 2627, 2640, 2653, 2670, 2687, 2704, 2721, 
+	2738, 2751, 2764, 2781, 2798, 2815, 2832, 2849, 
+	2862, 2875, 2892, 2909, 2926, 2943, 2955, 2972, 
+	2985, 2998, 3010, 3027, 3043, 3056, 3068, 3085, 
+	3101, 3114, 3126, 3143, 3159, 3172, 3184, 3201, 
+	3217, 3230, 3242, 3253, 3261, 3267, 3269, 3271, 
+	3287, 3295, 3298, 3306, 3318, 3331, 3344, 3356, 
+	3367, 3380, 3392, 3403, 3416, 3428, 3439, 3452, 
+	3464, 3474, 3487, 3504, 3517, 3530, 3547, 3564, 
+	3581, 3598, 3615, 3628, 3641, 3658, 3675, 3692, 
+	3709, 3726, 3739, 3752, 3769, 3786, 3803, 3820, 
+	3837, 3850, 3863, 3880, 3897, 3914, 3931, 3948, 
+	3960, 3973, 3985, 3998, 4011, 4023, 4040, 4056, 
+	4069, 4081, 4098, 4114, 4127, 4139, 4156, 4172, 
+	4185, 4197, 4214, 4230, 4243, 4255, 4266, 4274, 
+	4280, 4282, 4284, 4300, 4308, 4311, 4319, 4331, 
+	4344, 4357, 4369, 4380, 4393, 4405, 4416, 4429, 
+	4441, 4452, 4465, 4477, 4487, 4500, 4517, 4530, 
+	4543, 4560, 4577, 4594, 4611, 4628, 4641, 4654, 
+	4671, 4688, 4705, 4722, 4739, 4752, 4765, 4782, 
+	4799, 4816, 4833, 4850, 4863, 4876, 4893, 4910, 
+	4927, 4944, 4961, 4974, 4991, 5007, 5024, 5036, 
+	5053, 5069, 5082, 5094, 5100, 5102, 5104, 5117, 
+	5130, 5147, 5160, 5172, 5183, 5196, 5208, 5219, 
+	5232, 5244, 5255, 5268, 5280, 5288, 5304, 5312, 
+	5315, 5323, 5335
 };
 
 static const short _indic_syllable_machine_indicies[] = {
@@ -285,7 +306,7 @@ static const short _indic_syllable_machine_indicies[] = {
 	76, 76, 76, 76, 76, 76, 109, 76, 
 	109, 80, 80, 81, 76, 76, 76, 76, 
 	76, 110, 109, 76, 111, 80, 80, 81, 
-	76, 76, 76, 76, 76, 76, 111, 76, 
+	82, 82, 82, 82, 82, 82, 111, 82, 
 	111, 80, 80, 81, 76, 76, 76, 76, 
 	76, 112, 111, 76, 113, 80, 80, 81, 
 	76, 76, 76, 76, 76, 76, 113, 76, 
@@ -315,577 +336,640 @@ static const short _indic_syllable_machine_indicies[] = {
 	114, 149, 148, 114, 150, 118, 118, 119, 
 	114, 114, 114, 114, 114, 114, 150, 114, 
 	150, 118, 118, 119, 114, 114, 114, 114, 
-	114, 151, 150, 114, 153, 154, 155, 156, 
-	157, 158, 81, 159, 160, 152, 161, 161, 
-	162, 163, 164, 165, 152, 167, 168, 169, 
-	170, 5, 171, 172, 173, 166, 166, 37, 
-	174, 166, 166, 153, 166, 175, 168, 176, 
-	176, 5, 171, 172, 173, 166, 166, 166, 
-	174, 166, 168, 176, 176, 5, 171, 172, 
-	173, 166, 166, 166, 174, 166, 177, 166, 
-	166, 166, 18, 178, 166, 171, 172, 166, 
-	166, 166, 166, 179, 166, 177, 166, 180, 
-	181, 182, 183, 5, 171, 172, 173, 166, 
-	166, 35, 184, 166, 166, 177, 166, 185, 
-	181, 186, 186, 5, 171, 172, 173, 166, 
-	166, 166, 184, 166, 181, 186, 186, 5, 
-	171, 172, 173, 166, 166, 166, 184, 166, 
-	187, 166, 166, 166, 18, 188, 166, 171, 
-	172, 166, 166, 166, 166, 179, 166, 187, 
-	166, 189, 190, 191, 192, 5, 171, 172, 
-	173, 166, 166, 33, 193, 166, 166, 187, 
-	166, 194, 190, 195, 195, 5, 171, 172, 
-	173, 166, 166, 166, 193, 166, 190, 195, 
-	195, 5, 171, 172, 173, 166, 166, 166, 
-	193, 166, 196, 166, 166, 166, 18, 197, 
-	166, 171, 172, 166, 166, 166, 166, 179, 
-	166, 196, 166, 198, 199, 200, 201, 5, 
-	171, 172, 173, 166, 166, 31, 202, 166, 
-	166, 196, 166, 203, 199, 204, 204, 5, 
-	171, 172, 173, 166, 166, 166, 202, 166, 
-	199, 204, 204, 5, 171, 172, 173, 166, 
-	166, 166, 202, 166, 205, 166, 166, 166, 
-	18, 206, 166, 171, 172, 166, 166, 166, 
-	166, 179, 166, 205, 166, 207, 208, 209, 
-	210, 5, 171, 172, 173, 166, 166, 29, 
-	211, 166, 166, 205, 166, 212, 208, 213, 
-	213, 5, 171, 172, 173, 166, 166, 166, 
-	211, 166, 208, 213, 213, 5, 171, 172, 
-	173, 166, 166, 166, 211, 166, 18, 214, 
-	166, 171, 172, 166, 166, 166, 166, 179, 
-	166, 171, 172, 166, 166, 166, 166, 179, 
-	166, 215, 166, 166, 166, 172, 166, 172, 
-	166, 216, 166, 217, 166, 218, 219, 166, 
-	171, 172, 166, 166, 166, 3, 166, 166, 
-	166, 1, 166, 2, 166, 166, 166, 166, 
-	171, 172, 166, 171, 172, 166, 217, 166, 
-	166, 166, 166, 171, 172, 166, 217, 166, 
-	218, 166, 166, 171, 172, 166, 166, 166, 
-	3, 166, 18, 166, 220, 220, 5, 171, 
-	172, 166, 166, 166, 166, 179, 166, 221, 
-	27, 222, 223, 8, 171, 172, 166, 166, 
-	166, 166, 179, 166, 27, 222, 223, 8, 
-	171, 172, 166, 166, 166, 166, 179, 166, 
-	222, 222, 8, 171, 172, 166, 166, 166, 
-	166, 179, 166, 224, 24, 225, 226, 11, 
-	171, 172, 166, 166, 166, 166, 179, 166, 
-	24, 225, 226, 11, 171, 172, 166, 166, 
-	166, 166, 179, 166, 225, 225, 11, 171, 
-	172, 166, 166, 166, 166, 179, 166, 227, 
-	21, 228, 229, 14, 171, 172, 166, 166, 
-	166, 166, 179, 166, 21, 228, 229, 14, 
-	171, 172, 166, 166, 166, 166, 179, 166, 
-	228, 228, 14, 171, 172, 166, 166, 166, 
-	166, 179, 166, 230, 18, 166, 231, 166, 
-	171, 172, 166, 166, 166, 166, 179, 166, 
-	18, 166, 231, 166, 171, 172, 166, 166, 
-	166, 166, 179, 166, 232, 166, 171, 172, 
-	166, 166, 166, 166, 179, 166, 18, 166, 
-	166, 166, 166, 171, 172, 166, 166, 166, 
-	166, 179, 166, 208, 213, 213, 5, 171, 
-	172, 166, 166, 166, 166, 211, 166, 1, 
-	2, 166, 166, 18, 214, 166, 171, 172, 
-	166, 166, 166, 166, 179, 166, 1, 166, 
-	207, 208, 213, 213, 5, 171, 172, 173, 
-	166, 166, 166, 211, 166, 207, 208, 209, 
-	213, 5, 171, 172, 173, 166, 166, 29, 
-	211, 166, 205, 166, 233, 166, 220, 220, 
-	5, 171, 172, 166, 166, 166, 166, 179, 
-	166, 205, 166, 205, 166, 166, 166, 166, 
-	166, 166, 171, 172, 166, 166, 166, 166, 
-	179, 166, 205, 166, 205, 166, 166, 166, 
-	166, 234, 166, 171, 172, 166, 166, 166, 
-	166, 179, 166, 205, 166, 205, 166, 233, 
-	166, 166, 166, 166, 171, 172, 166, 166, 
-	166, 166, 179, 166, 205, 166, 205, 2, 
-	166, 166, 18, 206, 166, 171, 172, 166, 
-	166, 166, 166, 179, 166, 205, 166, 198, 
-	199, 204, 204, 5, 171, 172, 173, 166, 
-	166, 166, 202, 166, 198, 199, 200, 204, 
-	5, 171, 172, 173, 166, 166, 31, 202, 
-	166, 196, 166, 235, 166, 220, 220, 5, 
-	171, 172, 166, 166, 166, 166, 179, 166, 
-	196, 166, 196, 166, 166, 166, 166, 166, 
-	166, 171, 172, 166, 166, 166, 166, 179, 
-	166, 196, 166, 196, 166, 166, 166, 166, 
-	236, 166, 171, 172, 166, 166, 166, 166, 
-	179, 166, 196, 166, 196, 166, 235, 166, 
-	166, 166, 166, 171, 172, 166, 166, 166, 
-	166, 179, 166, 196, 166, 196, 2, 166, 
-	166, 18, 197, 166, 171, 172, 166, 166, 
-	166, 166, 179, 166, 196, 166, 189, 190, 
-	195, 195, 5, 171, 172, 173, 166, 166, 
-	166, 193, 166, 189, 190, 191, 195, 5, 
-	171, 172, 173, 166, 166, 33, 193, 166, 
-	187, 166, 237, 166, 220, 220, 5, 171, 
-	172, 166, 166, 166, 166, 179, 166, 187, 
-	166, 187, 166, 166, 166, 166, 166, 166, 
-	171, 172, 166, 166, 166, 166, 179, 166, 
-	187, 166, 187, 166, 166, 166, 166, 238, 
-	166, 171, 172, 166, 166, 166, 166, 179, 
-	166, 187, 166, 187, 166, 237, 166, 166, 
-	166, 166, 171, 172, 166, 166, 166, 166, 
-	179, 166, 187, 166, 187, 2, 166, 166, 
-	18, 188, 166, 171, 172, 166, 166, 166, 
-	166, 179, 166, 187, 166, 180, 181, 186, 
-	186, 5, 171, 172, 173, 166, 166, 166, 
-	184, 166, 180, 181, 182, 186, 5, 171, 
-	172, 173, 166, 166, 35, 184, 166, 177, 
-	166, 239, 166, 220, 220, 5, 171, 172, 
-	166, 166, 166, 166, 179, 166, 177, 166, 
-	177, 166, 166, 166, 166, 166, 166, 171, 
-	172, 166, 166, 166, 166, 179, 166, 177, 
-	166, 177, 166, 166, 166, 166, 240, 166, 
-	171, 172, 166, 166, 166, 166, 179, 166, 
-	177, 166, 177, 166, 239, 166, 166, 166, 
-	166, 171, 172, 166, 166, 166, 166, 179, 
-	166, 177, 166, 177, 2, 166, 166, 18, 
-	178, 166, 171, 172, 166, 166, 166, 166, 
-	179, 166, 177, 166, 167, 168, 176, 176, 
-	5, 171, 172, 173, 166, 166, 166, 174, 
-	166, 167, 168, 169, 176, 5, 171, 172, 
-	173, 166, 166, 37, 174, 166, 242, 243, 
-	244, 245, 43, 246, 247, 241, 241, 241, 
-	75, 248, 241, 249, 243, 250, 245, 43, 
-	246, 247, 241, 241, 241, 241, 248, 241, 
-	243, 250, 245, 43, 246, 247, 241, 241, 
-	241, 241, 248, 241, 251, 241, 241, 241, 
-	56, 252, 241, 246, 247, 241, 241, 241, 
-	241, 253, 241, 251, 241, 254, 255, 256, 
-	257, 43, 246, 247, 241, 241, 241, 73, 
-	258, 241, 241, 251, 241, 259, 255, 260, 
-	260, 43, 246, 247, 241, 241, 241, 241, 
-	258, 241, 255, 260, 260, 43, 246, 247, 
-	241, 241, 241, 241, 258, 241, 261, 241, 
-	241, 241, 56, 262, 241, 246, 247, 241, 
-	241, 241, 241, 253, 241, 261, 241, 263, 
-	264, 265, 266, 43, 246, 247, 241, 241, 
-	241, 71, 267, 241, 241, 261, 241, 268, 
-	264, 269, 269, 43, 246, 247, 241, 241, 
-	241, 241, 267, 241, 264, 269, 269, 43, 
-	246, 247, 241, 241, 241, 241, 267, 241, 
-	270, 241, 241, 241, 56, 271, 241, 246, 
-	247, 241, 241, 241, 241, 253, 241, 270, 
-	241, 272, 273, 274, 275, 43, 246, 247, 
-	241, 241, 241, 69, 276, 241, 241, 270, 
-	241, 277, 273, 278, 278, 43, 246, 247, 
-	241, 241, 241, 241, 276, 241, 273, 278, 
-	278, 43, 246, 247, 241, 241, 241, 241, 
-	276, 241, 279, 241, 241, 241, 56, 280, 
-	241, 246, 247, 241, 241, 241, 241, 253, 
-	241, 279, 241, 281, 282, 283, 284, 43, 
-	246, 247, 241, 241, 241, 67, 285, 241, 
-	241, 279, 241, 286, 282, 287, 287, 43, 
-	246, 247, 241, 241, 241, 241, 285, 241, 
-	282, 287, 287, 43, 246, 247, 241, 241, 
-	241, 241, 285, 241, 56, 288, 241, 246, 
-	247, 241, 241, 241, 241, 253, 241, 246, 
-	247, 241, 241, 241, 241, 253, 241, 289, 
-	241, 241, 241, 247, 241, 247, 241, 290, 
-	241, 291, 241, 292, 293, 241, 246, 247, 
-	241, 241, 241, 41, 241, 241, 241, 39, 
-	241, 40, 241, 241, 241, 241, 246, 247, 
-	241, 246, 247, 241, 291, 241, 241, 241, 
-	241, 246, 247, 241, 291, 241, 292, 241, 
-	241, 246, 247, 241, 241, 241, 41, 241, 
-	56, 241, 294, 294, 43, 246, 247, 241, 
-	241, 241, 241, 253, 241, 295, 65, 296, 
-	297, 46, 246, 247, 241, 241, 241, 241, 
-	253, 241, 65, 296, 297, 46, 246, 247, 
-	241, 241, 241, 241, 253, 241, 296, 296, 
-	46, 246, 247, 241, 241, 241, 241, 253, 
-	241, 298, 62, 299, 300, 49, 246, 247, 
-	241, 241, 241, 241, 253, 241, 62, 299, 
-	300, 49, 246, 247, 241, 241, 241, 241, 
-	253, 241, 299, 299, 49, 246, 247, 241, 
-	241, 241, 241, 253, 241, 301, 59, 302, 
-	303, 52, 246, 247, 241, 241, 241, 241, 
-	253, 241, 59, 302, 303, 52, 246, 247, 
-	241, 241, 241, 241, 253, 241, 302, 302, 
-	52, 246, 247, 241, 241, 241, 241, 253, 
-	241, 304, 56, 241, 305, 241, 246, 247, 
-	241, 241, 241, 241, 253, 241, 56, 241, 
-	305, 241, 246, 247, 241, 241, 241, 241, 
-	253, 241, 306, 241, 246, 247, 241, 241, 
-	241, 241, 253, 241, 56, 241, 241, 241, 
-	241, 246, 247, 241, 241, 241, 241, 253, 
-	241, 39, 40, 241, 241, 56, 288, 241, 
-	246, 247, 241, 241, 241, 241, 253, 241, 
-	39, 241, 281, 282, 287, 287, 43, 246, 
-	247, 241, 241, 241, 241, 285, 241, 281, 
-	282, 283, 287, 43, 246, 247, 241, 241, 
-	241, 67, 285, 241, 279, 241, 307, 241, 
-	294, 294, 43, 246, 247, 241, 241, 241, 
-	241, 253, 241, 279, 241, 279, 241, 241, 
-	241, 241, 241, 241, 246, 247, 241, 241, 
-	241, 241, 253, 241, 279, 241, 279, 241, 
-	241, 241, 241, 308, 241, 246, 247, 241, 
-	241, 241, 241, 253, 241, 279, 241, 279, 
-	241, 307, 241, 241, 241, 241, 246, 247, 
-	241, 241, 241, 241, 253, 241, 279, 241, 
-	279, 40, 241, 241, 56, 280, 241, 246, 
-	247, 241, 241, 241, 241, 253, 241, 279, 
-	241, 272, 273, 278, 278, 43, 246, 247, 
-	241, 241, 241, 241, 276, 241, 272, 273, 
-	274, 278, 43, 246, 247, 241, 241, 241, 
-	69, 276, 241, 270, 241, 309, 241, 294, 
-	294, 43, 246, 247, 241, 241, 241, 241, 
-	253, 241, 270, 241, 270, 241, 241, 241, 
-	241, 241, 241, 246, 247, 241, 241, 241, 
-	241, 253, 241, 270, 241, 270, 241, 241, 
-	241, 241, 310, 241, 246, 247, 241, 241, 
-	241, 241, 253, 241, 270, 241, 270, 241, 
-	309, 241, 241, 241, 241, 246, 247, 241, 
-	241, 241, 241, 253, 241, 270, 241, 270, 
-	40, 241, 241, 56, 271, 241, 246, 247, 
-	241, 241, 241, 241, 253, 241, 270, 241, 
-	263, 264, 269, 269, 43, 246, 247, 241, 
-	241, 241, 241, 267, 241, 263, 264, 265, 
-	269, 43, 246, 247, 241, 241, 241, 71, 
-	267, 241, 261, 241, 311, 241, 294, 294, 
-	43, 246, 247, 241, 241, 241, 241, 253, 
-	241, 261, 241, 261, 241, 241, 241, 241, 
-	241, 241, 246, 247, 241, 241, 241, 241, 
-	253, 241, 261, 241, 261, 241, 241, 241, 
-	241, 312, 241, 246, 247, 241, 241, 241, 
-	241, 253, 241, 261, 241, 261, 241, 311, 
-	241, 241, 241, 241, 246, 247, 241, 241, 
-	241, 241, 253, 241, 261, 241, 261, 40, 
-	241, 241, 56, 262, 241, 246, 247, 241, 
-	241, 241, 241, 253, 241, 261, 241, 254, 
-	255, 260, 260, 43, 246, 247, 241, 241, 
-	241, 241, 258, 241, 254, 255, 256, 260, 
-	43, 246, 247, 241, 241, 241, 73, 258, 
-	241, 251, 241, 313, 241, 294, 294, 43, 
-	246, 247, 241, 241, 241, 241, 253, 241, 
-	251, 241, 251, 241, 241, 241, 241, 241, 
-	241, 246, 247, 241, 241, 241, 241, 253, 
-	241, 251, 241, 251, 241, 241, 241, 241, 
-	314, 241, 246, 247, 241, 241, 241, 241, 
-	253, 241, 251, 241, 251, 241, 313, 241, 
-	241, 241, 241, 246, 247, 241, 241, 241, 
-	241, 253, 241, 251, 241, 74, 42, 42, 
-	43, 241, 241, 241, 241, 241, 241, 74, 
-	241, 251, 40, 241, 241, 56, 252, 241, 
-	246, 247, 241, 241, 241, 241, 253, 241, 
-	251, 241, 242, 243, 250, 245, 43, 246, 
-	247, 241, 241, 241, 241, 248, 241, 316, 
-	156, 317, 317, 81, 159, 160, 315, 315, 
-	315, 315, 163, 315, 156, 317, 317, 81, 
-	159, 160, 315, 315, 315, 315, 163, 315, 
-	318, 315, 315, 315, 95, 319, 315, 159, 
-	160, 315, 315, 315, 315, 320, 315, 318, 
-	315, 321, 322, 323, 324, 81, 159, 160, 
-	315, 315, 315, 112, 325, 315, 315, 318, 
-	315, 326, 322, 327, 327, 81, 159, 160, 
-	315, 315, 315, 315, 325, 315, 322, 327, 
-	327, 81, 159, 160, 315, 315, 315, 315, 
-	325, 315, 328, 315, 315, 315, 95, 329, 
-	315, 159, 160, 315, 315, 315, 315, 320, 
-	315, 328, 315, 330, 331, 332, 333, 81, 
-	159, 160, 315, 315, 315, 110, 334, 315, 
-	315, 328, 315, 335, 331, 336, 336, 81, 
-	159, 160, 315, 315, 315, 315, 334, 315, 
-	331, 336, 336, 81, 159, 160, 315, 315, 
-	315, 315, 334, 315, 337, 315, 315, 315, 
-	95, 338, 315, 159, 160, 315, 315, 315, 
-	315, 320, 315, 337, 315, 339, 340, 341, 
-	342, 81, 159, 160, 315, 315, 315, 108, 
-	343, 315, 315, 337, 315, 344, 340, 345, 
-	345, 81, 159, 160, 315, 315, 315, 315, 
-	343, 315, 340, 345, 345, 81, 159, 160, 
-	315, 315, 315, 315, 343, 315, 346, 315, 
-	315, 315, 95, 347, 315, 159, 160, 315, 
-	315, 315, 315, 320, 315, 346, 315, 348, 
-	349, 350, 351, 81, 159, 160, 315, 315, 
-	315, 106, 352, 315, 315, 346, 315, 353, 
-	349, 354, 354, 81, 159, 160, 315, 315, 
-	315, 315, 352, 315, 349, 354, 354, 81, 
-	159, 160, 315, 315, 315, 315, 352, 315, 
-	95, 355, 315, 159, 160, 315, 315, 315, 
-	315, 320, 315, 159, 160, 315, 315, 315, 
-	315, 320, 315, 356, 315, 315, 315, 160, 
-	315, 160, 315, 357, 315, 358, 315, 359, 
-	360, 315, 159, 160, 315, 315, 315, 79, 
-	315, 315, 315, 77, 315, 78, 315, 315, 
-	315, 315, 159, 160, 315, 159, 160, 315, 
-	358, 315, 315, 315, 315, 159, 160, 315, 
-	358, 315, 359, 315, 315, 159, 160, 315, 
-	315, 315, 79, 315, 95, 315, 361, 361, 
-	81, 159, 160, 315, 315, 315, 315, 320, 
-	315, 362, 104, 363, 364, 85, 159, 160, 
-	315, 315, 315, 315, 320, 315, 104, 363, 
-	364, 85, 159, 160, 315, 315, 315, 315, 
-	320, 315, 363, 363, 85, 159, 160, 315, 
-	315, 315, 315, 320, 315, 365, 101, 366, 
-	367, 88, 159, 160, 315, 315, 315, 315, 
-	320, 315, 101, 366, 367, 88, 159, 160, 
-	315, 315, 315, 315, 320, 315, 366, 366, 
-	88, 159, 160, 315, 315, 315, 315, 320, 
-	315, 368, 98, 369, 370, 91, 159, 160, 
-	315, 315, 315, 315, 320, 315, 98, 369, 
-	370, 91, 159, 160, 315, 315, 315, 315, 
-	320, 315, 369, 369, 91, 159, 160, 315, 
-	315, 315, 315, 320, 315, 371, 95, 315, 
-	372, 315, 159, 160, 315, 315, 315, 315, 
-	320, 315, 95, 315, 372, 315, 159, 160, 
-	315, 315, 315, 315, 320, 315, 373, 315, 
-	159, 160, 315, 315, 315, 315, 320, 315, 
-	95, 315, 315, 315, 315, 159, 160, 315, 
-	315, 315, 315, 320, 315, 77, 78, 315, 
-	315, 95, 355, 315, 159, 160, 315, 315, 
-	315, 315, 320, 315, 77, 315, 348, 349, 
-	354, 354, 81, 159, 160, 315, 315, 315, 
-	315, 352, 315, 348, 349, 350, 354, 81, 
-	159, 160, 315, 315, 315, 106, 352, 315, 
-	346, 315, 374, 315, 361, 361, 81, 159, 
-	160, 315, 315, 315, 315, 320, 315, 346, 
-	315, 346, 315, 315, 315, 315, 315, 315, 
-	159, 160, 315, 315, 315, 315, 320, 315, 
-	346, 315, 346, 315, 315, 315, 315, 375, 
-	315, 159, 160, 315, 315, 315, 315, 320, 
-	315, 346, 315, 346, 315, 374, 315, 315, 
-	315, 315, 159, 160, 315, 315, 315, 315, 
-	320, 315, 346, 315, 346, 78, 315, 315, 
-	95, 347, 315, 159, 160, 315, 315, 315, 
-	315, 320, 315, 346, 315, 339, 340, 345, 
-	345, 81, 159, 160, 315, 315, 315, 315, 
-	343, 315, 339, 340, 341, 345, 81, 159, 
-	160, 315, 315, 315, 108, 343, 315, 337, 
-	315, 376, 315, 361, 361, 81, 159, 160, 
-	315, 315, 315, 315, 320, 315, 337, 315, 
-	337, 315, 315, 315, 315, 315, 315, 159, 
-	160, 315, 315, 315, 315, 320, 315, 337, 
-	315, 337, 315, 315, 315, 315, 377, 315, 
-	159, 160, 315, 315, 315, 315, 320, 315, 
-	337, 315, 337, 315, 376, 315, 315, 315, 
-	315, 159, 160, 315, 315, 315, 315, 320, 
-	315, 337, 315, 337, 78, 315, 315, 95, 
-	338, 315, 159, 160, 315, 315, 315, 315, 
-	320, 315, 337, 315, 330, 331, 336, 336, 
-	81, 159, 160, 315, 315, 315, 315, 334, 
-	315, 330, 331, 332, 336, 81, 159, 160, 
-	315, 315, 315, 110, 334, 315, 328, 315, 
-	378, 315, 361, 361, 81, 159, 160, 315, 
-	315, 315, 315, 320, 315, 328, 315, 328, 
-	315, 315, 315, 315, 315, 315, 159, 160, 
-	315, 315, 315, 315, 320, 315, 328, 315, 
-	328, 315, 315, 315, 315, 379, 315, 159, 
-	160, 315, 315, 315, 315, 320, 315, 328, 
-	315, 328, 315, 378, 315, 315, 315, 315, 
-	159, 160, 315, 315, 315, 315, 320, 315, 
-	328, 315, 328, 78, 315, 315, 95, 329, 
-	315, 159, 160, 315, 315, 315, 315, 320, 
-	315, 328, 315, 321, 322, 327, 327, 81, 
-	159, 160, 315, 315, 315, 315, 325, 315, 
-	321, 322, 323, 327, 81, 159, 160, 315, 
-	315, 315, 112, 325, 315, 318, 315, 380, 
-	315, 361, 361, 81, 159, 160, 315, 315, 
-	315, 315, 320, 315, 318, 315, 318, 315, 
-	315, 315, 315, 315, 315, 159, 160, 315, 
-	315, 315, 315, 320, 315, 318, 315, 318, 
-	315, 315, 315, 315, 381, 315, 159, 160, 
-	315, 315, 315, 315, 320, 315, 318, 315, 
-	318, 315, 380, 315, 315, 315, 315, 159, 
-	160, 315, 315, 315, 315, 320, 315, 318, 
-	315, 318, 78, 315, 315, 95, 319, 315, 
-	159, 160, 315, 315, 315, 315, 320, 315, 
-	318, 315, 113, 80, 80, 81, 382, 382, 
-	382, 382, 382, 162, 113, 382, 155, 156, 
-	317, 317, 81, 159, 160, 315, 315, 315, 
-	315, 163, 315, 113, 80, 80, 81, 382, 
-	382, 382, 382, 382, 382, 113, 382, 384, 
-	385, 386, 387, 119, 388, 389, 383, 383, 
-	383, 151, 390, 383, 391, 385, 387, 387, 
-	119, 388, 389, 383, 383, 383, 383, 390, 
-	383, 385, 387, 387, 119, 388, 389, 383, 
-	383, 383, 383, 390, 383, 392, 383, 383, 
-	383, 132, 393, 383, 388, 389, 383, 383, 
-	383, 383, 394, 383, 392, 383, 395, 396, 
-	397, 398, 119, 388, 389, 383, 383, 383, 
-	149, 399, 383, 383, 392, 383, 400, 396, 
-	401, 401, 119, 388, 389, 383, 383, 383, 
-	383, 399, 383, 396, 401, 401, 119, 388, 
-	389, 383, 383, 383, 383, 399, 383, 402, 
-	383, 383, 383, 132, 403, 383, 388, 389, 
-	383, 383, 383, 383, 394, 383, 402, 383, 
-	404, 405, 406, 407, 119, 388, 389, 383, 
-	383, 383, 147, 408, 383, 383, 402, 383, 
-	409, 405, 410, 410, 119, 388, 389, 383, 
-	383, 383, 383, 408, 383, 405, 410, 410, 
-	119, 388, 389, 383, 383, 383, 383, 408, 
-	383, 411, 383, 383, 383, 132, 412, 383, 
-	388, 389, 383, 383, 383, 383, 394, 383, 
-	411, 383, 413, 414, 415, 416, 119, 388, 
-	389, 383, 383, 383, 145, 417, 383, 383, 
-	411, 383, 418, 414, 419, 419, 119, 388, 
-	389, 383, 383, 383, 383, 417, 383, 414, 
-	419, 419, 119, 388, 389, 383, 383, 383, 
-	383, 417, 383, 420, 383, 383, 383, 132, 
-	421, 383, 388, 389, 383, 383, 383, 383, 
-	394, 383, 420, 383, 422, 423, 424, 425, 
-	119, 388, 389, 383, 383, 383, 143, 426, 
-	383, 383, 420, 383, 427, 423, 428, 428, 
-	119, 388, 389, 383, 383, 383, 383, 426, 
-	383, 423, 428, 428, 119, 388, 389, 383, 
-	383, 383, 383, 426, 383, 132, 429, 383, 
-	388, 389, 383, 383, 383, 383, 394, 383, 
-	388, 389, 383, 383, 383, 383, 394, 383, 
-	430, 383, 383, 383, 389, 383, 389, 383, 
-	431, 383, 432, 383, 433, 434, 383, 388, 
-	389, 383, 383, 383, 117, 383, 383, 383, 
-	115, 383, 116, 383, 383, 383, 383, 388, 
-	389, 383, 388, 389, 383, 432, 383, 383, 
-	383, 383, 388, 389, 383, 432, 383, 433, 
-	383, 383, 388, 389, 383, 383, 383, 117, 
-	383, 132, 383, 435, 435, 119, 388, 389, 
-	383, 383, 383, 383, 394, 383, 436, 141, 
-	437, 438, 122, 388, 389, 383, 383, 383, 
-	383, 394, 383, 141, 437, 438, 122, 388, 
-	389, 383, 383, 383, 383, 394, 383, 437, 
-	437, 122, 388, 389, 383, 383, 383, 383, 
-	394, 383, 439, 138, 440, 441, 125, 388, 
-	389, 383, 383, 383, 383, 394, 383, 138, 
-	440, 441, 125, 388, 389, 383, 383, 383, 
-	383, 394, 383, 440, 440, 125, 388, 389, 
-	383, 383, 383, 383, 394, 383, 442, 135, 
-	443, 444, 128, 388, 389, 383, 383, 383, 
-	383, 394, 383, 135, 443, 444, 128, 388, 
-	389, 383, 383, 383, 383, 394, 383, 443, 
-	443, 128, 388, 389, 383, 383, 383, 383, 
-	394, 383, 445, 132, 383, 446, 383, 388, 
-	389, 383, 383, 383, 383, 394, 383, 132, 
-	383, 446, 383, 388, 389, 383, 383, 383, 
-	383, 394, 383, 447, 383, 388, 389, 383, 
-	383, 383, 383, 394, 383, 132, 383, 383, 
-	383, 383, 388, 389, 383, 383, 383, 383, 
-	394, 383, 115, 116, 383, 383, 132, 429, 
-	383, 388, 389, 383, 383, 383, 383, 394, 
-	383, 115, 383, 422, 423, 428, 428, 119, 
-	388, 389, 383, 383, 383, 383, 426, 383, 
-	422, 423, 424, 428, 119, 388, 389, 383, 
-	383, 383, 143, 426, 383, 420, 383, 448, 
-	383, 435, 435, 119, 388, 389, 383, 383, 
-	383, 383, 394, 383, 420, 383, 420, 383, 
-	383, 383, 383, 383, 383, 388, 389, 383, 
-	383, 383, 383, 394, 383, 420, 383, 420, 
-	383, 383, 383, 383, 449, 383, 388, 389, 
-	383, 383, 383, 383, 394, 383, 420, 383, 
-	420, 383, 448, 383, 383, 383, 383, 388, 
-	389, 383, 383, 383, 383, 394, 383, 420, 
-	383, 420, 116, 383, 383, 132, 421, 383, 
-	388, 389, 383, 383, 383, 383, 394, 383, 
-	420, 383, 413, 414, 419, 419, 119, 388, 
-	389, 383, 383, 383, 383, 417, 383, 413, 
-	414, 415, 419, 119, 388, 389, 383, 383, 
-	383, 145, 417, 383, 411, 383, 450, 383, 
-	435, 435, 119, 388, 389, 383, 383, 383, 
-	383, 394, 383, 411, 383, 411, 383, 383, 
-	383, 383, 383, 383, 388, 389, 383, 383, 
-	383, 383, 394, 383, 411, 383, 411, 383, 
-	383, 383, 383, 451, 383, 388, 389, 383, 
-	383, 383, 383, 394, 383, 411, 383, 411, 
-	383, 450, 383, 383, 383, 383, 388, 389, 
-	383, 383, 383, 383, 394, 383, 411, 383, 
-	411, 116, 383, 383, 132, 412, 383, 388, 
-	389, 383, 383, 383, 383, 394, 383, 411, 
-	383, 404, 405, 410, 410, 119, 388, 389, 
-	383, 383, 383, 383, 408, 383, 404, 405, 
-	406, 410, 119, 388, 389, 383, 383, 383, 
-	147, 408, 383, 402, 383, 452, 383, 435, 
-	435, 119, 388, 389, 383, 383, 383, 383, 
-	394, 383, 402, 383, 402, 383, 383, 383, 
-	383, 383, 383, 388, 389, 383, 383, 383, 
-	383, 394, 383, 402, 383, 402, 383, 383, 
-	383, 383, 453, 383, 388, 389, 383, 383, 
-	383, 383, 394, 383, 402, 383, 402, 383, 
-	452, 383, 383, 383, 383, 388, 389, 383, 
-	383, 383, 383, 394, 383, 402, 383, 402, 
-	116, 383, 383, 132, 403, 383, 388, 389, 
-	383, 383, 383, 383, 394, 383, 402, 383, 
-	395, 396, 401, 401, 119, 388, 389, 383, 
-	383, 383, 383, 399, 383, 395, 396, 397, 
-	401, 119, 388, 389, 383, 383, 383, 149, 
-	399, 383, 392, 383, 454, 383, 435, 435, 
-	119, 388, 389, 383, 383, 383, 383, 394, 
-	383, 392, 383, 392, 383, 383, 383, 383, 
-	383, 383, 388, 389, 383, 383, 383, 383, 
-	394, 383, 392, 383, 392, 383, 383, 383, 
-	383, 455, 383, 388, 389, 383, 383, 383, 
-	383, 394, 383, 392, 383, 392, 383, 454, 
-	383, 383, 383, 383, 388, 389, 383, 383, 
-	383, 383, 394, 383, 392, 383, 392, 116, 
-	383, 383, 132, 393, 383, 388, 389, 383, 
-	383, 383, 383, 394, 383, 392, 383, 384, 
-	385, 387, 387, 119, 388, 389, 383, 383, 
-	383, 383, 390, 383, 153, 154, 382, 382, 
-	382, 382, 382, 382, 382, 382, 161, 161, 
-	382, 382, 382, 153, 382, 167, 456, 169, 
-	170, 5, 171, 172, 173, 166, 166, 37, 
-	174, 166, 166, 153, 166, 177, 154, 166, 
-	166, 18, 178, 166, 171, 172, 166, 161, 
-	161, 166, 179, 166, 177, 166, 0
+	114, 151, 150, 114, 113, 80, 80, 81, 
+	76, 76, 76, 76, 76, 152, 113, 76, 
+	111, 80, 80, 81, 0, 0, 0, 0, 
+	0, 153, 111, 0, 154, 154, 155, 0, 
+	6, 6, 155, 0, 156, 156, 157, 0, 
+	158, 158, 157, 0, 157, 0, 159, 159, 
+	160, 0, 161, 161, 160, 0, 160, 0, 
+	162, 162, 163, 0, 164, 164, 163, 0, 
+	163, 0, 165, 166, 0, 0, 0, 0, 
+	0, 0, 0, 0, 0, 0, 0, 0, 
+	0, 165, 0, 167, 0, 168, 0, 169, 
+	0, 170, 0, 171, 162, 162, 163, 0, 
+	172, 0, 173, 0, 174, 159, 159, 160, 
+	0, 175, 0, 176, 0, 177, 156, 156, 
+	157, 0, 178, 0, 179, 0, 181, 182, 
+	183, 184, 185, 186, 81, 187, 188, 180, 
+	189, 189, 152, 190, 191, 192, 180, 194, 
+	195, 196, 197, 5, 198, 199, 200, 193, 
+	193, 37, 201, 193, 193, 181, 193, 202, 
+	195, 203, 203, 5, 198, 199, 200, 193, 
+	193, 193, 201, 193, 195, 203, 203, 5, 
+	198, 199, 200, 193, 193, 193, 201, 193, 
+	204, 193, 193, 193, 18, 205, 193, 198, 
+	199, 193, 193, 193, 193, 206, 193, 204, 
+	193, 207, 208, 209, 210, 5, 198, 199, 
+	200, 193, 193, 35, 211, 193, 193, 204, 
+	193, 212, 208, 213, 213, 5, 198, 199, 
+	200, 193, 193, 193, 211, 193, 208, 213, 
+	213, 5, 198, 199, 200, 193, 193, 193, 
+	211, 193, 214, 193, 193, 193, 18, 215, 
+	193, 198, 199, 193, 193, 193, 193, 206, 
+	193, 214, 193, 216, 217, 218, 219, 5, 
+	198, 199, 200, 193, 193, 33, 220, 193, 
+	193, 214, 193, 221, 217, 222, 222, 5, 
+	198, 199, 200, 193, 193, 193, 220, 193, 
+	217, 222, 222, 5, 198, 199, 200, 193, 
+	193, 193, 220, 193, 223, 193, 193, 193, 
+	18, 224, 193, 198, 199, 193, 193, 193, 
+	193, 206, 193, 223, 193, 225, 226, 227, 
+	228, 5, 198, 199, 200, 193, 193, 31, 
+	229, 193, 193, 223, 193, 230, 226, 231, 
+	231, 5, 198, 199, 200, 193, 193, 193, 
+	229, 193, 226, 231, 231, 5, 198, 199, 
+	200, 193, 193, 193, 229, 193, 232, 193, 
+	193, 193, 18, 233, 193, 198, 199, 193, 
+	193, 193, 193, 206, 193, 232, 193, 234, 
+	235, 236, 237, 5, 198, 199, 200, 193, 
+	193, 29, 238, 193, 193, 232, 193, 239, 
+	235, 240, 240, 5, 198, 199, 200, 193, 
+	193, 193, 238, 193, 235, 240, 240, 5, 
+	198, 199, 200, 193, 193, 193, 238, 193, 
+	18, 241, 193, 198, 199, 193, 193, 193, 
+	193, 206, 193, 198, 199, 193, 193, 193, 
+	193, 206, 193, 242, 193, 193, 193, 199, 
+	193, 199, 193, 243, 193, 244, 193, 245, 
+	246, 193, 198, 199, 193, 193, 193, 3, 
+	193, 193, 193, 1, 193, 2, 193, 193, 
+	193, 193, 198, 199, 193, 198, 199, 193, 
+	244, 193, 193, 193, 193, 198, 199, 193, 
+	244, 193, 245, 193, 193, 198, 199, 193, 
+	193, 193, 3, 193, 18, 193, 247, 247, 
+	5, 198, 199, 193, 193, 193, 193, 206, 
+	193, 248, 27, 249, 250, 8, 198, 199, 
+	193, 193, 193, 193, 206, 193, 27, 249, 
+	250, 8, 198, 199, 193, 193, 193, 193, 
+	206, 193, 249, 249, 8, 198, 199, 193, 
+	193, 193, 193, 206, 193, 251, 24, 252, 
+	253, 11, 198, 199, 193, 193, 193, 193, 
+	206, 193, 24, 252, 253, 11, 198, 199, 
+	193, 193, 193, 193, 206, 193, 252, 252, 
+	11, 198, 199, 193, 193, 193, 193, 206, 
+	193, 254, 21, 255, 256, 14, 198, 199, 
+	193, 193, 193, 193, 206, 193, 21, 255, 
+	256, 14, 198, 199, 193, 193, 193, 193, 
+	206, 193, 255, 255, 14, 198, 199, 193, 
+	193, 193, 193, 206, 193, 257, 18, 193, 
+	258, 193, 198, 199, 193, 193, 193, 193, 
+	206, 193, 18, 193, 258, 193, 198, 199, 
+	193, 193, 193, 193, 206, 193, 259, 193, 
+	198, 199, 193, 193, 193, 193, 206, 193, 
+	18, 193, 193, 193, 193, 198, 199, 193, 
+	193, 193, 193, 206, 193, 235, 240, 240, 
+	5, 198, 199, 193, 193, 193, 193, 238, 
+	193, 1, 2, 193, 193, 18, 241, 193, 
+	198, 199, 193, 193, 193, 193, 206, 193, 
+	1, 193, 234, 235, 240, 240, 5, 198, 
+	199, 200, 193, 193, 193, 238, 193, 234, 
+	235, 236, 240, 5, 198, 199, 200, 193, 
+	193, 29, 238, 193, 232, 193, 260, 193, 
+	247, 247, 5, 198, 199, 193, 193, 193, 
+	193, 206, 193, 232, 193, 232, 193, 193, 
+	193, 193, 193, 193, 198, 199, 193, 193, 
+	193, 193, 206, 193, 232, 193, 232, 193, 
+	193, 193, 193, 261, 193, 198, 199, 193, 
+	193, 193, 193, 206, 193, 232, 193, 232, 
+	193, 260, 193, 193, 193, 193, 198, 199, 
+	193, 193, 193, 193, 206, 193, 232, 193, 
+	232, 2, 193, 193, 18, 233, 193, 198, 
+	199, 193, 193, 193, 193, 206, 193, 232, 
+	193, 225, 226, 231, 231, 5, 198, 199, 
+	200, 193, 193, 193, 229, 193, 225, 226, 
+	227, 231, 5, 198, 199, 200, 193, 193, 
+	31, 229, 193, 223, 193, 262, 193, 247, 
+	247, 5, 198, 199, 193, 193, 193, 193, 
+	206, 193, 223, 193, 223, 193, 193, 193, 
+	193, 193, 193, 198, 199, 193, 193, 193, 
+	193, 206, 193, 223, 193, 223, 193, 193, 
+	193, 193, 263, 193, 198, 199, 193, 193, 
+	193, 193, 206, 193, 223, 193, 223, 193, 
+	262, 193, 193, 193, 193, 198, 199, 193, 
+	193, 193, 193, 206, 193, 223, 193, 223, 
+	2, 193, 193, 18, 224, 193, 198, 199, 
+	193, 193, 193, 193, 206, 193, 223, 193, 
+	216, 217, 222, 222, 5, 198, 199, 200, 
+	193, 193, 193, 220, 193, 216, 217, 218, 
+	222, 5, 198, 199, 200, 193, 193, 33, 
+	220, 193, 214, 193, 264, 193, 247, 247, 
+	5, 198, 199, 193, 193, 193, 193, 206, 
+	193, 214, 193, 214, 193, 193, 193, 193, 
+	193, 193, 198, 199, 193, 193, 193, 193, 
+	206, 193, 214, 193, 214, 193, 193, 193, 
+	193, 265, 193, 198, 199, 193, 193, 193, 
+	193, 206, 193, 214, 193, 214, 193, 264, 
+	193, 193, 193, 193, 198, 199, 193, 193, 
+	193, 193, 206, 193, 214, 193, 214, 2, 
+	193, 193, 18, 215, 193, 198, 199, 193, 
+	193, 193, 193, 206, 193, 214, 193, 207, 
+	208, 213, 213, 5, 198, 199, 200, 193, 
+	193, 193, 211, 193, 207, 208, 209, 213, 
+	5, 198, 199, 200, 193, 193, 35, 211, 
+	193, 204, 193, 266, 193, 247, 247, 5, 
+	198, 199, 193, 193, 193, 193, 206, 193, 
+	204, 193, 204, 193, 193, 193, 193, 193, 
+	193, 198, 199, 193, 193, 193, 193, 206, 
+	193, 204, 193, 204, 193, 193, 193, 193, 
+	267, 193, 198, 199, 193, 193, 193, 193, 
+	206, 193, 204, 193, 204, 193, 266, 193, 
+	193, 193, 193, 198, 199, 193, 193, 193, 
+	193, 206, 193, 204, 193, 204, 2, 193, 
+	193, 18, 205, 193, 198, 199, 193, 193, 
+	193, 193, 206, 193, 204, 193, 194, 195, 
+	203, 203, 5, 198, 199, 200, 193, 193, 
+	193, 201, 193, 194, 195, 196, 203, 5, 
+	198, 199, 200, 193, 193, 37, 201, 193, 
+	269, 270, 271, 272, 43, 273, 274, 268, 
+	268, 268, 75, 275, 268, 276, 270, 277, 
+	272, 43, 273, 274, 268, 268, 268, 268, 
+	275, 268, 270, 277, 272, 43, 273, 274, 
+	268, 268, 268, 268, 275, 268, 278, 268, 
+	268, 268, 56, 279, 268, 273, 274, 268, 
+	268, 268, 268, 280, 268, 278, 268, 281, 
+	282, 283, 284, 43, 273, 274, 268, 268, 
+	268, 73, 285, 268, 268, 278, 268, 286, 
+	282, 287, 287, 43, 273, 274, 268, 268, 
+	268, 268, 285, 268, 282, 287, 287, 43, 
+	273, 274, 268, 268, 268, 268, 285, 268, 
+	288, 268, 268, 268, 56, 289, 268, 273, 
+	274, 268, 268, 268, 268, 280, 268, 288, 
+	268, 290, 291, 292, 293, 43, 273, 274, 
+	268, 268, 268, 71, 294, 268, 268, 288, 
+	268, 295, 291, 296, 296, 43, 273, 274, 
+	268, 268, 268, 268, 294, 268, 291, 296, 
+	296, 43, 273, 274, 268, 268, 268, 268, 
+	294, 268, 297, 268, 268, 268, 56, 298, 
+	268, 273, 274, 268, 268, 268, 268, 280, 
+	268, 297, 268, 299, 300, 301, 302, 43, 
+	273, 274, 268, 268, 268, 69, 303, 268, 
+	268, 297, 268, 304, 300, 305, 305, 43, 
+	273, 274, 268, 268, 268, 268, 303, 268, 
+	300, 305, 305, 43, 273, 274, 268, 268, 
+	268, 268, 303, 268, 306, 268, 268, 268, 
+	56, 307, 268, 273, 274, 268, 268, 268, 
+	268, 280, 268, 306, 268, 308, 309, 310, 
+	311, 43, 273, 274, 268, 268, 268, 67, 
+	312, 268, 268, 306, 268, 313, 309, 314, 
+	314, 43, 273, 274, 268, 268, 268, 268, 
+	312, 268, 309, 314, 314, 43, 273, 274, 
+	268, 268, 268, 268, 312, 268, 56, 315, 
+	268, 273, 274, 268, 268, 268, 268, 280, 
+	268, 273, 274, 268, 268, 268, 268, 280, 
+	268, 316, 268, 268, 268, 274, 268, 274, 
+	268, 317, 268, 318, 268, 319, 320, 268, 
+	273, 274, 268, 268, 268, 41, 268, 268, 
+	268, 39, 268, 40, 268, 268, 268, 268, 
+	273, 274, 268, 273, 274, 268, 318, 268, 
+	268, 268, 268, 273, 274, 268, 318, 268, 
+	319, 268, 268, 273, 274, 268, 268, 268, 
+	41, 268, 56, 268, 321, 321, 43, 273, 
+	274, 268, 268, 268, 268, 280, 268, 322, 
+	65, 323, 324, 46, 273, 274, 268, 268, 
+	268, 268, 280, 268, 65, 323, 324, 46, 
+	273, 274, 268, 268, 268, 268, 280, 268, 
+	323, 323, 46, 273, 274, 268, 268, 268, 
+	268, 280, 268, 325, 62, 326, 327, 49, 
+	273, 274, 268, 268, 268, 268, 280, 268, 
+	62, 326, 327, 49, 273, 274, 268, 268, 
+	268, 268, 280, 268, 326, 326, 49, 273, 
+	274, 268, 268, 268, 268, 280, 268, 328, 
+	59, 329, 330, 52, 273, 274, 268, 268, 
+	268, 268, 280, 268, 59, 329, 330, 52, 
+	273, 274, 268, 268, 268, 268, 280, 268, 
+	329, 329, 52, 273, 274, 268, 268, 268, 
+	268, 280, 268, 331, 56, 268, 332, 268, 
+	273, 274, 268, 268, 268, 268, 280, 268, 
+	56, 268, 332, 268, 273, 274, 268, 268, 
+	268, 268, 280, 268, 333, 268, 273, 274, 
+	268, 268, 268, 268, 280, 268, 56, 268, 
+	268, 268, 268, 273, 274, 268, 268, 268, 
+	268, 280, 268, 39, 40, 268, 268, 56, 
+	315, 268, 273, 274, 268, 268, 268, 268, 
+	280, 268, 39, 268, 308, 309, 314, 314, 
+	43, 273, 274, 268, 268, 268, 268, 312, 
+	268, 308, 309, 310, 314, 43, 273, 274, 
+	268, 268, 268, 67, 312, 268, 306, 268, 
+	334, 268, 321, 321, 43, 273, 274, 268, 
+	268, 268, 268, 280, 268, 306, 268, 306, 
+	268, 268, 268, 268, 268, 268, 273, 274, 
+	268, 268, 268, 268, 280, 268, 306, 268, 
+	306, 268, 268, 268, 268, 335, 268, 273, 
+	274, 268, 268, 268, 268, 280, 268, 306, 
+	268, 306, 268, 334, 268, 268, 268, 268, 
+	273, 274, 268, 268, 268, 268, 280, 268, 
+	306, 268, 306, 40, 268, 268, 56, 307, 
+	268, 273, 274, 268, 268, 268, 268, 280, 
+	268, 306, 268, 299, 300, 305, 305, 43, 
+	273, 274, 268, 268, 268, 268, 303, 268, 
+	299, 300, 301, 305, 43, 273, 274, 268, 
+	268, 268, 69, 303, 268, 297, 268, 336, 
+	268, 321, 321, 43, 273, 274, 268, 268, 
+	268, 268, 280, 268, 297, 268, 297, 268, 
+	268, 268, 268, 268, 268, 273, 274, 268, 
+	268, 268, 268, 280, 268, 297, 268, 297, 
+	268, 268, 268, 268, 337, 268, 273, 274, 
+	268, 268, 268, 268, 280, 268, 297, 268, 
+	297, 268, 336, 268, 268, 268, 268, 273, 
+	274, 268, 268, 268, 268, 280, 268, 297, 
+	268, 297, 40, 268, 268, 56, 298, 268, 
+	273, 274, 268, 268, 268, 268, 280, 268, 
+	297, 268, 290, 291, 296, 296, 43, 273, 
+	274, 268, 268, 268, 268, 294, 268, 290, 
+	291, 292, 296, 43, 273, 274, 268, 268, 
+	268, 71, 294, 268, 288, 268, 338, 268, 
+	321, 321, 43, 273, 274, 268, 268, 268, 
+	268, 280, 268, 288, 268, 288, 268, 268, 
+	268, 268, 268, 268, 273, 274, 268, 268, 
+	268, 268, 280, 268, 288, 268, 288, 268, 
+	268, 268, 268, 339, 268, 273, 274, 268, 
+	268, 268, 268, 280, 268, 288, 268, 288, 
+	268, 338, 268, 268, 268, 268, 273, 274, 
+	268, 268, 268, 268, 280, 268, 288, 268, 
+	288, 40, 268, 268, 56, 289, 268, 273, 
+	274, 268, 268, 268, 268, 280, 268, 288, 
+	268, 281, 282, 287, 287, 43, 273, 274, 
+	268, 268, 268, 268, 285, 268, 281, 282, 
+	283, 287, 43, 273, 274, 268, 268, 268, 
+	73, 285, 268, 278, 268, 340, 268, 321, 
+	321, 43, 273, 274, 268, 268, 268, 268, 
+	280, 268, 278, 268, 278, 268, 268, 268, 
+	268, 268, 268, 273, 274, 268, 268, 268, 
+	268, 280, 268, 278, 268, 278, 268, 268, 
+	268, 268, 341, 268, 273, 274, 268, 268, 
+	268, 268, 280, 268, 278, 268, 278, 268, 
+	340, 268, 268, 268, 268, 273, 274, 268, 
+	268, 268, 268, 280, 268, 278, 268, 74, 
+	42, 42, 43, 268, 268, 268, 268, 268, 
+	268, 74, 268, 278, 40, 268, 268, 56, 
+	279, 268, 273, 274, 268, 268, 268, 268, 
+	280, 268, 278, 268, 269, 270, 277, 272, 
+	43, 273, 274, 268, 268, 268, 268, 275, 
+	268, 343, 184, 344, 344, 81, 187, 188, 
+	342, 342, 342, 342, 190, 342, 184, 344, 
+	344, 81, 187, 188, 342, 342, 342, 342, 
+	190, 342, 345, 342, 342, 342, 95, 346, 
+	342, 187, 188, 342, 342, 342, 342, 347, 
+	342, 345, 342, 348, 349, 350, 351, 81, 
+	187, 188, 342, 342, 342, 112, 352, 342, 
+	342, 345, 342, 353, 349, 354, 354, 81, 
+	187, 188, 342, 342, 342, 342, 352, 342, 
+	349, 354, 354, 81, 187, 188, 342, 342, 
+	342, 342, 352, 342, 355, 342, 342, 342, 
+	95, 356, 342, 187, 188, 342, 342, 342, 
+	342, 347, 342, 355, 342, 357, 358, 359, 
+	360, 81, 187, 188, 342, 342, 342, 110, 
+	361, 342, 342, 355, 342, 362, 358, 363, 
+	363, 81, 187, 188, 342, 342, 342, 342, 
+	361, 342, 358, 363, 363, 81, 187, 188, 
+	342, 342, 342, 342, 361, 342, 364, 342, 
+	342, 342, 95, 365, 342, 187, 188, 342, 
+	342, 342, 342, 347, 342, 364, 342, 366, 
+	367, 368, 369, 81, 187, 188, 342, 342, 
+	342, 108, 370, 342, 342, 364, 342, 371, 
+	367, 372, 372, 81, 187, 188, 342, 342, 
+	342, 342, 370, 342, 367, 372, 372, 81, 
+	187, 188, 342, 342, 342, 342, 370, 342, 
+	373, 342, 342, 342, 95, 374, 342, 187, 
+	188, 342, 342, 342, 342, 347, 342, 373, 
+	342, 375, 376, 377, 378, 81, 187, 188, 
+	342, 342, 342, 106, 379, 342, 342, 373, 
+	342, 380, 376, 381, 381, 81, 187, 188, 
+	342, 342, 342, 342, 379, 342, 376, 381, 
+	381, 81, 187, 188, 342, 342, 342, 342, 
+	379, 342, 95, 382, 342, 187, 188, 342, 
+	342, 342, 342, 347, 342, 187, 188, 342, 
+	342, 342, 342, 347, 342, 383, 342, 342, 
+	342, 188, 342, 188, 342, 384, 342, 385, 
+	342, 386, 387, 342, 187, 188, 342, 342, 
+	342, 79, 342, 342, 342, 77, 342, 78, 
+	342, 342, 342, 342, 187, 188, 342, 187, 
+	188, 342, 385, 342, 342, 342, 342, 187, 
+	188, 342, 385, 342, 386, 342, 342, 187, 
+	188, 342, 342, 342, 79, 342, 95, 342, 
+	388, 388, 81, 187, 188, 342, 342, 342, 
+	342, 347, 342, 389, 104, 390, 391, 85, 
+	187, 188, 342, 342, 342, 342, 347, 342, 
+	104, 390, 391, 85, 187, 188, 342, 342, 
+	342, 342, 347, 342, 390, 390, 85, 187, 
+	188, 342, 342, 342, 342, 347, 342, 392, 
+	101, 393, 394, 88, 187, 188, 342, 342, 
+	342, 342, 347, 342, 101, 393, 394, 88, 
+	187, 188, 342, 342, 342, 342, 347, 342, 
+	393, 393, 88, 187, 188, 342, 342, 342, 
+	342, 347, 342, 395, 98, 396, 397, 91, 
+	187, 188, 342, 342, 342, 342, 347, 342, 
+	98, 396, 397, 91, 187, 188, 342, 342, 
+	342, 342, 347, 342, 396, 396, 91, 187, 
+	188, 342, 342, 342, 342, 347, 342, 398, 
+	95, 342, 399, 342, 187, 188, 342, 342, 
+	342, 342, 347, 342, 95, 342, 399, 342, 
+	187, 188, 342, 342, 342, 342, 347, 342, 
+	400, 342, 187, 188, 342, 342, 342, 342, 
+	347, 342, 95, 342, 342, 342, 342, 187, 
+	188, 342, 342, 342, 342, 347, 342, 77, 
+	78, 342, 342, 95, 382, 342, 187, 188, 
+	342, 342, 342, 342, 347, 342, 77, 342, 
+	375, 376, 381, 381, 81, 187, 188, 342, 
+	342, 342, 342, 379, 342, 375, 376, 377, 
+	381, 81, 187, 188, 342, 342, 342, 106, 
+	379, 342, 373, 342, 401, 342, 388, 388, 
+	81, 187, 188, 342, 342, 342, 342, 347, 
+	342, 373, 342, 373, 342, 342, 342, 342, 
+	342, 342, 187, 188, 342, 342, 342, 342, 
+	347, 342, 373, 342, 373, 342, 342, 342, 
+	342, 402, 342, 187, 188, 342, 342, 342, 
+	342, 347, 342, 373, 342, 373, 342, 401, 
+	342, 342, 342, 342, 187, 188, 342, 342, 
+	342, 342, 347, 342, 373, 342, 373, 78, 
+	342, 342, 95, 374, 342, 187, 188, 342, 
+	342, 342, 342, 347, 342, 373, 342, 366, 
+	367, 372, 372, 81, 187, 188, 342, 342, 
+	342, 342, 370, 342, 366, 367, 368, 372, 
+	81, 187, 188, 342, 342, 342, 108, 370, 
+	342, 364, 342, 403, 342, 388, 388, 81, 
+	187, 188, 342, 342, 342, 342, 347, 342, 
+	364, 342, 364, 342, 342, 342, 342, 342, 
+	342, 187, 188, 342, 342, 342, 342, 347, 
+	342, 364, 342, 364, 342, 342, 342, 342, 
+	404, 342, 187, 188, 342, 342, 342, 342, 
+	347, 342, 364, 342, 364, 342, 403, 342, 
+	342, 342, 342, 187, 188, 342, 342, 342, 
+	342, 347, 342, 364, 342, 364, 78, 342, 
+	342, 95, 365, 342, 187, 188, 342, 342, 
+	342, 342, 347, 342, 364, 342, 357, 358, 
+	363, 363, 81, 187, 188, 342, 342, 342, 
+	342, 361, 342, 357, 358, 359, 363, 81, 
+	187, 188, 342, 342, 342, 110, 361, 342, 
+	355, 342, 405, 342, 388, 388, 81, 187, 
+	188, 342, 342, 342, 342, 347, 342, 355, 
+	342, 355, 342, 342, 342, 342, 342, 342, 
+	187, 188, 342, 342, 342, 342, 347, 342, 
+	355, 342, 355, 342, 342, 342, 342, 406, 
+	342, 187, 188, 342, 342, 342, 342, 347, 
+	342, 355, 342, 355, 342, 405, 342, 342, 
+	342, 342, 187, 188, 342, 342, 342, 342, 
+	347, 342, 355, 342, 355, 78, 342, 342, 
+	95, 356, 342, 187, 188, 342, 342, 342, 
+	342, 347, 342, 355, 342, 348, 349, 354, 
+	354, 81, 187, 188, 342, 342, 342, 342, 
+	352, 342, 348, 349, 350, 354, 81, 187, 
+	188, 342, 342, 342, 112, 352, 342, 345, 
+	342, 407, 342, 388, 388, 81, 187, 188, 
+	342, 342, 342, 342, 347, 342, 345, 342, 
+	345, 342, 342, 342, 342, 342, 342, 187, 
+	188, 342, 342, 342, 342, 347, 342, 345, 
+	342, 345, 342, 342, 342, 342, 408, 342, 
+	187, 188, 342, 342, 342, 342, 347, 342, 
+	345, 342, 345, 342, 407, 342, 342, 342, 
+	342, 187, 188, 342, 342, 342, 342, 347, 
+	342, 345, 342, 345, 78, 342, 342, 95, 
+	346, 342, 187, 188, 342, 342, 342, 342, 
+	347, 342, 345, 342, 113, 80, 80, 81, 
+	409, 409, 409, 409, 409, 152, 113, 409, 
+	183, 184, 344, 344, 81, 187, 188, 342, 
+	342, 342, 342, 190, 342, 113, 80, 80, 
+	81, 409, 409, 409, 409, 409, 409, 113, 
+	409, 411, 412, 413, 414, 119, 415, 416, 
+	410, 410, 410, 151, 417, 410, 418, 412, 
+	414, 414, 119, 415, 416, 410, 410, 410, 
+	410, 417, 410, 412, 414, 414, 119, 415, 
+	416, 410, 410, 410, 410, 417, 410, 419, 
+	410, 410, 410, 132, 420, 410, 415, 416, 
+	410, 410, 410, 410, 421, 410, 419, 410, 
+	422, 423, 424, 425, 119, 415, 416, 410, 
+	410, 410, 149, 426, 410, 410, 419, 410, 
+	427, 423, 428, 428, 119, 415, 416, 410, 
+	410, 410, 410, 426, 410, 423, 428, 428, 
+	119, 415, 416, 410, 410, 410, 410, 426, 
+	410, 429, 410, 410, 410, 132, 430, 410, 
+	415, 416, 410, 410, 410, 410, 421, 410, 
+	429, 410, 431, 432, 433, 434, 119, 415, 
+	416, 410, 410, 410, 147, 435, 410, 410, 
+	429, 410, 436, 432, 437, 437, 119, 415, 
+	416, 410, 410, 410, 410, 435, 410, 432, 
+	437, 437, 119, 415, 416, 410, 410, 410, 
+	410, 435, 410, 438, 410, 410, 410, 132, 
+	439, 410, 415, 416, 410, 410, 410, 410, 
+	421, 410, 438, 410, 440, 441, 442, 443, 
+	119, 415, 416, 410, 410, 410, 145, 444, 
+	410, 410, 438, 410, 445, 441, 446, 446, 
+	119, 415, 416, 410, 410, 410, 410, 444, 
+	410, 441, 446, 446, 119, 415, 416, 410, 
+	410, 410, 410, 444, 410, 447, 410, 410, 
+	410, 132, 448, 410, 415, 416, 410, 410, 
+	410, 410, 421, 410, 447, 410, 449, 450, 
+	451, 452, 119, 415, 416, 410, 410, 410, 
+	143, 453, 410, 410, 447, 410, 454, 450, 
+	455, 455, 119, 415, 416, 410, 410, 410, 
+	410, 453, 410, 450, 455, 455, 119, 415, 
+	416, 410, 410, 410, 410, 453, 410, 132, 
+	456, 410, 415, 416, 410, 410, 410, 410, 
+	421, 410, 415, 416, 410, 410, 410, 410, 
+	421, 410, 457, 410, 410, 410, 416, 410, 
+	416, 410, 458, 410, 459, 410, 460, 461, 
+	410, 415, 416, 410, 410, 410, 117, 410, 
+	410, 410, 115, 410, 116, 410, 410, 410, 
+	410, 415, 416, 410, 415, 416, 410, 459, 
+	410, 410, 410, 410, 415, 416, 410, 459, 
+	410, 460, 410, 410, 415, 416, 410, 410, 
+	410, 117, 410, 132, 410, 462, 462, 119, 
+	415, 416, 410, 410, 410, 410, 421, 410, 
+	463, 141, 464, 465, 122, 415, 416, 410, 
+	410, 410, 410, 421, 410, 141, 464, 465, 
+	122, 415, 416, 410, 410, 410, 410, 421, 
+	410, 464, 464, 122, 415, 416, 410, 410, 
+	410, 410, 421, 410, 466, 138, 467, 468, 
+	125, 415, 416, 410, 410, 410, 410, 421, 
+	410, 138, 467, 468, 125, 415, 416, 410, 
+	410, 410, 410, 421, 410, 467, 467, 125, 
+	415, 416, 410, 410, 410, 410, 421, 410, 
+	469, 135, 470, 471, 128, 415, 416, 410, 
+	410, 410, 410, 421, 410, 135, 470, 471, 
+	128, 415, 416, 410, 410, 410, 410, 421, 
+	410, 470, 470, 128, 415, 416, 410, 410, 
+	410, 410, 421, 410, 472, 132, 410, 473, 
+	410, 415, 416, 410, 410, 410, 410, 421, 
+	410, 132, 410, 473, 410, 415, 416, 410, 
+	410, 410, 410, 421, 410, 474, 410, 415, 
+	416, 410, 410, 410, 410, 421, 410, 132, 
+	410, 410, 410, 410, 415, 416, 410, 410, 
+	410, 410, 421, 410, 115, 116, 410, 410, 
+	132, 456, 410, 415, 416, 410, 410, 410, 
+	410, 421, 410, 115, 410, 449, 450, 455, 
+	455, 119, 415, 416, 410, 410, 410, 410, 
+	453, 410, 449, 450, 451, 455, 119, 415, 
+	416, 410, 410, 410, 143, 453, 410, 447, 
+	410, 475, 410, 462, 462, 119, 415, 416, 
+	410, 410, 410, 410, 421, 410, 447, 410, 
+	447, 410, 410, 410, 410, 410, 410, 415, 
+	416, 410, 410, 410, 410, 421, 410, 447, 
+	410, 447, 410, 410, 410, 410, 476, 410, 
+	415, 416, 410, 410, 410, 410, 421, 410, 
+	447, 410, 447, 410, 475, 410, 410, 410, 
+	410, 415, 416, 410, 410, 410, 410, 421, 
+	410, 447, 410, 447, 116, 410, 410, 132, 
+	448, 410, 415, 416, 410, 410, 410, 410, 
+	421, 410, 447, 410, 440, 441, 446, 446, 
+	119, 415, 416, 410, 410, 410, 410, 444, 
+	410, 440, 441, 442, 446, 119, 415, 416, 
+	410, 410, 410, 145, 444, 410, 438, 410, 
+	477, 410, 462, 462, 119, 415, 416, 410, 
+	410, 410, 410, 421, 410, 438, 410, 438, 
+	410, 410, 410, 410, 410, 410, 415, 416, 
+	410, 410, 410, 410, 421, 410, 438, 410, 
+	438, 410, 410, 410, 410, 478, 410, 415, 
+	416, 410, 410, 410, 410, 421, 410, 438, 
+	410, 438, 410, 477, 410, 410, 410, 410, 
+	415, 416, 410, 410, 410, 410, 421, 410, 
+	438, 410, 438, 116, 410, 410, 132, 439, 
+	410, 415, 416, 410, 410, 410, 410, 421, 
+	410, 438, 410, 431, 432, 437, 437, 119, 
+	415, 416, 410, 410, 410, 410, 435, 410, 
+	431, 432, 433, 437, 119, 415, 416, 410, 
+	410, 410, 147, 435, 410, 429, 410, 479, 
+	410, 462, 462, 119, 415, 416, 410, 410, 
+	410, 410, 421, 410, 429, 410, 429, 410, 
+	410, 410, 410, 410, 410, 415, 416, 410, 
+	410, 410, 410, 421, 410, 429, 410, 429, 
+	410, 410, 410, 410, 480, 410, 415, 416, 
+	410, 410, 410, 410, 421, 410, 429, 410, 
+	429, 410, 479, 410, 410, 410, 410, 415, 
+	416, 410, 410, 410, 410, 421, 410, 429, 
+	410, 429, 116, 410, 410, 132, 430, 410, 
+	415, 416, 410, 410, 410, 410, 421, 410, 
+	429, 410, 422, 423, 428, 428, 119, 415, 
+	416, 410, 410, 410, 410, 426, 410, 422, 
+	423, 424, 428, 119, 415, 416, 410, 410, 
+	410, 149, 426, 410, 419, 410, 481, 410, 
+	462, 462, 119, 415, 416, 410, 410, 410, 
+	410, 421, 410, 419, 410, 419, 410, 410, 
+	410, 410, 410, 410, 415, 416, 410, 410, 
+	410, 410, 421, 410, 419, 410, 419, 410, 
+	410, 410, 410, 482, 410, 415, 416, 410, 
+	410, 410, 410, 421, 410, 419, 410, 419, 
+	410, 481, 410, 410, 410, 410, 415, 416, 
+	410, 410, 410, 410, 421, 410, 419, 410, 
+	419, 116, 410, 410, 132, 420, 410, 415, 
+	416, 410, 410, 410, 410, 421, 410, 419, 
+	410, 411, 412, 414, 414, 119, 415, 416, 
+	410, 410, 410, 410, 417, 410, 181, 182, 
+	183, 184, 483, 344, 81, 187, 188, 342, 
+	189, 189, 152, 190, 342, 181, 342, 194, 
+	484, 196, 197, 5, 198, 199, 200, 193, 
+	193, 37, 201, 193, 193, 181, 193, 204, 
+	182, 183, 184, 485, 486, 81, 487, 488, 
+	193, 189, 189, 152, 489, 193, 204, 193, 
+	113, 80, 80, 81, 198, 199, 193, 193, 
+	193, 152, 490, 193, 491, 2, 342, 342, 
+	342, 408, 342, 187, 188, 342, 342, 342, 
+	342, 347, 342, 491, 342, 492, 349, 493, 
+	494, 81, 487, 488, 193, 193, 193, 153, 
+	352, 193, 193, 491, 193, 495, 349, 354, 
+	354, 81, 487, 488, 193, 193, 193, 193, 
+	352, 193, 349, 354, 354, 81, 487, 488, 
+	193, 193, 193, 193, 352, 193, 496, 193, 
+	193, 193, 488, 193, 488, 193, 243, 193, 
+	492, 349, 354, 354, 81, 487, 488, 193, 
+	193, 193, 193, 352, 193, 492, 349, 493, 
+	354, 81, 487, 488, 193, 193, 193, 153, 
+	352, 193, 204, 193, 266, 113, 497, 497, 
+	155, 198, 199, 193, 193, 193, 193, 490, 
+	193, 204, 193, 498, 179, 499, 500, 157, 
+	487, 488, 193, 193, 193, 193, 501, 193, 
+	179, 499, 500, 157, 487, 488, 193, 193, 
+	193, 193, 501, 193, 499, 499, 157, 487, 
+	488, 193, 193, 193, 193, 501, 193, 502, 
+	176, 503, 504, 160, 487, 488, 193, 193, 
+	193, 193, 501, 193, 176, 503, 504, 160, 
+	487, 488, 193, 193, 193, 193, 501, 193, 
+	503, 503, 160, 487, 488, 193, 193, 193, 
+	193, 501, 193, 505, 173, 506, 507, 163, 
+	487, 488, 193, 193, 193, 193, 501, 193, 
+	173, 506, 507, 163, 487, 488, 193, 193, 
+	193, 193, 501, 193, 506, 506, 163, 487, 
+	488, 193, 193, 193, 193, 501, 193, 508, 
+	170, 193, 509, 193, 487, 488, 193, 193, 
+	193, 193, 501, 193, 170, 193, 509, 193, 
+	487, 488, 193, 193, 193, 193, 501, 193, 
+	487, 488, 193, 193, 193, 193, 501, 193, 
+	510, 193, 511, 512, 193, 487, 488, 193, 
+	193, 193, 167, 193, 193, 193, 165, 193, 
+	166, 193, 193, 193, 193, 487, 488, 193, 
+	487, 488, 193, 510, 193, 193, 193, 193, 
+	487, 488, 193, 510, 193, 511, 193, 193, 
+	487, 488, 193, 193, 193, 167, 193, 491, 
+	166, 342, 342, 95, 346, 342, 187, 188, 
+	342, 342, 342, 342, 347, 342, 491, 342, 
+	0
 };
 
 static const short _indic_syllable_machine_trans_targs[] = {
-	143, 168, 170, 171, 3, 174, 4, 6, 
-	177, 7, 9, 180, 10, 12, 183, 13, 
-	15, 16, 164, 18, 19, 182, 21, 22, 
-	179, 24, 25, 176, 185, 189, 193, 196, 
-	200, 203, 207, 210, 214, 217, 143, 243, 
-	245, 246, 39, 249, 40, 42, 252, 43, 
-	45, 255, 46, 48, 258, 49, 51, 52, 
-	239, 54, 55, 257, 57, 58, 254, 60, 
-	61, 251, 260, 263, 267, 270, 274, 277, 
-	281, 284, 288, 292, 143, 316, 318, 319, 
-	75, 322, 143, 76, 78, 325, 79, 81, 
-	328, 82, 84, 331, 85, 87, 88, 312, 
-	90, 91, 330, 93, 94, 327, 96, 97, 
-	324, 333, 336, 340, 343, 347, 350, 354, 
-	357, 361, 143, 391, 393, 394, 110, 397, 
-	111, 113, 400, 114, 116, 403, 117, 119, 
-	406, 120, 122, 123, 387, 125, 126, 405, 
-	128, 129, 402, 131, 132, 399, 408, 411, 
-	415, 418, 422, 425, 429, 432, 436, 439, 
-	143, 144, 219, 293, 295, 364, 366, 313, 
-	315, 367, 365, 363, 440, 441, 143, 145, 
-	147, 35, 218, 165, 167, 187, 216, 146, 
-	34, 148, 212, 0, 149, 151, 33, 211, 
-	209, 150, 32, 152, 205, 153, 155, 31, 
-	204, 202, 154, 30, 156, 198, 157, 159, 
-	29, 197, 195, 158, 28, 160, 191, 161, 
-	163, 27, 190, 188, 162, 26, 173, 166, 
-	143, 169, 1, 172, 2, 175, 5, 23, 
-	178, 8, 20, 181, 11, 17, 184, 14, 
-	186, 192, 194, 199, 201, 206, 208, 213, 
-	215, 143, 220, 222, 71, 290, 240, 242, 
-	291, 221, 70, 223, 286, 36, 224, 226, 
-	69, 285, 283, 225, 68, 227, 279, 228, 
-	230, 67, 278, 276, 229, 66, 231, 272, 
-	232, 234, 65, 271, 269, 233, 64, 235, 
-	265, 236, 238, 63, 264, 262, 237, 62, 
-	248, 241, 143, 244, 37, 247, 38, 250, 
-	41, 59, 253, 44, 56, 256, 47, 53, 
-	259, 50, 261, 266, 268, 273, 275, 280, 
-	282, 287, 289, 143, 294, 106, 296, 359, 
-	72, 297, 299, 105, 358, 356, 298, 104, 
-	300, 352, 301, 303, 103, 351, 349, 302, 
-	102, 304, 345, 305, 307, 101, 344, 342, 
-	306, 100, 308, 338, 309, 311, 99, 337, 
-	335, 310, 98, 321, 314, 143, 317, 73, 
-	320, 74, 323, 77, 95, 326, 80, 92, 
-	329, 83, 89, 332, 86, 334, 339, 341, 
-	346, 348, 353, 355, 360, 362, 143, 143, 
-	368, 370, 142, 141, 388, 390, 438, 369, 
-	371, 434, 107, 372, 374, 140, 433, 431, 
-	373, 139, 375, 427, 376, 378, 138, 426, 
-	424, 377, 137, 379, 420, 380, 382, 136, 
-	419, 417, 381, 135, 383, 413, 384, 386, 
-	134, 412, 410, 385, 133, 396, 389, 143, 
-	392, 108, 395, 109, 398, 112, 130, 401, 
-	115, 127, 404, 118, 124, 407, 121, 409, 
-	414, 416, 421, 423, 428, 430, 435, 437, 
-	442
+	170, 195, 197, 198, 3, 201, 4, 6, 
+	204, 7, 9, 207, 10, 12, 210, 13, 
+	15, 16, 191, 18, 19, 209, 21, 22, 
+	206, 24, 25, 203, 212, 216, 220, 223, 
+	227, 230, 234, 237, 241, 244, 170, 270, 
+	272, 273, 39, 276, 40, 42, 279, 43, 
+	45, 282, 46, 48, 285, 49, 51, 52, 
+	266, 54, 55, 284, 57, 58, 281, 60, 
+	61, 278, 287, 290, 294, 297, 301, 304, 
+	308, 311, 315, 319, 170, 343, 345, 346, 
+	75, 349, 170, 76, 78, 352, 79, 81, 
+	355, 82, 84, 358, 85, 87, 88, 339, 
+	90, 91, 357, 93, 94, 354, 96, 97, 
+	351, 360, 363, 367, 370, 374, 377, 381, 
+	384, 388, 170, 418, 420, 421, 110, 424, 
+	111, 113, 427, 114, 116, 430, 117, 119, 
+	433, 120, 122, 123, 414, 125, 126, 432, 
+	128, 129, 429, 131, 132, 426, 435, 438, 
+	442, 445, 449, 452, 456, 459, 463, 466, 
+	392, 478, 146, 481, 148, 484, 149, 151, 
+	487, 152, 154, 490, 155, 493, 495, 496, 
+	159, 160, 492, 162, 163, 489, 165, 166, 
+	486, 168, 169, 483, 170, 171, 246, 320, 
+	322, 391, 393, 340, 342, 394, 390, 467, 
+	468, 170, 172, 174, 35, 245, 192, 194, 
+	214, 243, 173, 34, 175, 239, 0, 176, 
+	178, 33, 238, 236, 177, 32, 179, 232, 
+	180, 182, 31, 231, 229, 181, 30, 183, 
+	225, 184, 186, 29, 224, 222, 185, 28, 
+	187, 218, 188, 190, 27, 217, 215, 189, 
+	26, 200, 193, 170, 196, 1, 199, 2, 
+	202, 5, 23, 205, 8, 20, 208, 11, 
+	17, 211, 14, 213, 219, 221, 226, 228, 
+	233, 235, 240, 242, 170, 247, 249, 71, 
+	317, 267, 269, 318, 248, 70, 250, 313, 
+	36, 251, 253, 69, 312, 310, 252, 68, 
+	254, 306, 255, 257, 67, 305, 303, 256, 
+	66, 258, 299, 259, 261, 65, 298, 296, 
+	260, 64, 262, 292, 263, 265, 63, 291, 
+	289, 264, 62, 275, 268, 170, 271, 37, 
+	274, 38, 277, 41, 59, 280, 44, 56, 
+	283, 47, 53, 286, 50, 288, 293, 295, 
+	300, 302, 307, 309, 314, 316, 170, 321, 
+	106, 323, 386, 72, 324, 326, 105, 385, 
+	383, 325, 104, 327, 379, 328, 330, 103, 
+	378, 376, 329, 102, 331, 372, 332, 334, 
+	101, 371, 369, 333, 100, 335, 365, 336, 
+	338, 99, 364, 362, 337, 98, 348, 341, 
+	170, 344, 73, 347, 74, 350, 77, 95, 
+	353, 80, 92, 356, 83, 89, 359, 86, 
+	361, 366, 368, 373, 375, 380, 382, 387, 
+	389, 170, 170, 395, 397, 142, 141, 415, 
+	417, 465, 396, 398, 461, 107, 399, 401, 
+	140, 460, 458, 400, 139, 402, 454, 403, 
+	405, 138, 453, 451, 404, 137, 406, 447, 
+	407, 409, 136, 446, 444, 408, 135, 410, 
+	440, 411, 413, 134, 439, 437, 412, 133, 
+	423, 416, 170, 419, 108, 422, 109, 425, 
+	112, 130, 428, 115, 127, 431, 118, 124, 
+	434, 121, 436, 441, 443, 448, 450, 455, 
+	457, 462, 464, 143, 469, 470, 480, 475, 
+	477, 498, 471, 472, 473, 144, 479, 474, 
+	476, 145, 482, 147, 167, 156, 485, 150, 
+	164, 488, 153, 161, 491, 158, 494, 157, 
+	497
 };
 
 static const char _indic_syllable_machine_trans_actions[] = {
@@ -908,44 +992,51 @@ static const char _indic_syllable_machine_trans_actions[] = {
 	2, 0, 0, 0, 2, 0, 0, 2, 
 	0, 0, 2, 0, 0, 2, 2, 2, 
 	2, 2, 2, 2, 2, 2, 2, 2, 
-	10, 2, 2, 6, 2, 11, 11, 0, 
-	0, 2, 6, 2, 0, 2, 12, 2, 
-	2, 0, 2, 0, 0, 2, 2, 2, 
-	0, 2, 2, 0, 2, 2, 0, 2, 
-	2, 2, 0, 2, 2, 2, 2, 0, 
-	2, 2, 2, 0, 2, 2, 2, 2, 
-	0, 2, 2, 2, 0, 2, 2, 2, 
-	2, 0, 2, 2, 2, 0, 2, 0, 
-	13, 0, 0, 2, 0, 2, 0, 0, 
+	6, 8, 0, 2, 0, 2, 0, 0, 
+	2, 0, 0, 2, 0, 2, 0, 0, 
+	0, 0, 2, 0, 0, 2, 0, 0, 
+	2, 0, 0, 2, 11, 2, 2, 6, 
+	2, 12, 12, 0, 0, 2, 2, 6, 
+	2, 13, 2, 2, 0, 2, 0, 0, 
+	2, 2, 2, 0, 2, 2, 0, 2, 
+	2, 0, 2, 2, 2, 0, 2, 2, 
+	2, 2, 0, 2, 2, 2, 0, 2, 
+	2, 2, 2, 0, 2, 2, 2, 0, 
+	2, 2, 2, 2, 0, 2, 2, 2, 
+	0, 2, 0, 14, 0, 0, 2, 0, 
+	2, 0, 0, 2, 0, 0, 2, 0, 
+	0, 2, 0, 2, 2, 2, 2, 2, 
+	2, 2, 2, 2, 15, 2, 2, 0, 
+	2, 0, 0, 2, 2, 0, 2, 2, 
+	0, 2, 2, 0, 2, 2, 2, 0, 
+	2, 2, 2, 2, 0, 2, 2, 2, 
+	0, 2, 2, 2, 2, 0, 2, 2, 
+	2, 0, 2, 2, 2, 2, 0, 2, 
+	2, 2, 0, 2, 0, 16, 0, 0, 
+	2, 0, 2, 0, 0, 2, 0, 0, 
+	2, 0, 0, 2, 0, 2, 2, 2, 
+	2, 2, 2, 2, 2, 2, 17, 6, 
+	0, 6, 6, 0, 6, 2, 0, 6, 
+	2, 6, 0, 6, 6, 6, 2, 0, 
+	6, 2, 6, 0, 6, 6, 6, 2, 
+	0, 6, 2, 6, 0, 6, 6, 6, 
+	2, 0, 6, 2, 6, 0, 6, 0, 
+	18, 0, 0, 2, 0, 2, 0, 0, 
 	2, 0, 0, 2, 0, 0, 2, 0, 
 	2, 2, 2, 2, 2, 2, 2, 2, 
-	2, 14, 2, 2, 0, 2, 0, 0, 
-	2, 2, 0, 2, 2, 0, 2, 2, 
+	2, 19, 20, 2, 2, 0, 0, 0, 
+	0, 2, 2, 2, 2, 0, 2, 2, 
 	0, 2, 2, 2, 0, 2, 2, 2, 
 	2, 0, 2, 2, 2, 0, 2, 2, 
 	2, 2, 0, 2, 2, 2, 0, 2, 
 	2, 2, 2, 0, 2, 2, 2, 0, 
-	2, 0, 15, 0, 0, 2, 0, 2, 
+	2, 0, 21, 0, 0, 2, 0, 2, 
 	0, 0, 2, 0, 0, 2, 0, 0, 
 	2, 0, 2, 2, 2, 2, 2, 2, 
-	2, 2, 2, 16, 6, 0, 6, 6, 
-	0, 6, 2, 0, 6, 2, 6, 0, 
-	6, 6, 6, 2, 0, 6, 2, 6, 
-	0, 6, 6, 6, 2, 0, 6, 2, 
-	6, 0, 6, 6, 6, 2, 0, 6, 
-	2, 6, 0, 6, 0, 17, 0, 0, 
-	2, 0, 2, 0, 0, 2, 0, 0, 
-	2, 0, 0, 2, 0, 2, 2, 2, 
-	2, 2, 2, 2, 2, 2, 18, 19, 
-	2, 2, 0, 0, 0, 0, 2, 2, 
-	2, 2, 0, 2, 2, 0, 2, 2, 
-	2, 0, 2, 2, 2, 2, 0, 2, 
-	2, 2, 0, 2, 2, 2, 2, 0, 
-	2, 2, 2, 0, 2, 2, 2, 2, 
-	0, 2, 2, 2, 0, 2, 0, 20, 
-	0, 0, 2, 0, 2, 0, 0, 2, 
-	0, 0, 2, 0, 0, 2, 0, 2, 
-	2, 2, 2, 2, 2, 2, 2, 2, 
+	2, 2, 2, 0, 0, 8, 2, 0, 
+	0, 2, 2, 8, 8, 0, 8, 8, 
+	0, 0, 2, 0, 0, 0, 2, 0, 
+	0, 2, 0, 0, 2, 0, 0, 0, 
 	2
 };
 
@@ -967,7 +1058,14 @@ static const char _indic_syllable_machine_to_state_actions[] = {
 	0, 0, 0, 0, 0, 0, 0, 0, 
 	0, 0, 0, 0, 0, 0, 0, 0, 
 	0, 0, 0, 0, 0, 0, 0, 0, 
-	0, 0, 0, 0, 0, 0, 0, 8, 
+	0, 0, 0, 0, 0, 0, 0, 0, 
+	0, 0, 0, 0, 0, 0, 0, 0, 
+	0, 0, 0, 0, 0, 0, 0, 0, 
+	0, 0, 0, 0, 0, 0, 0, 0, 
+	0, 0, 9, 0, 0, 0, 0, 0, 
+	0, 0, 0, 0, 0, 0, 0, 0, 
+	0, 0, 0, 0, 0, 0, 0, 0, 
+	0, 0, 0, 0, 0, 0, 0, 0, 
 	0, 0, 0, 0, 0, 0, 0, 0, 
 	0, 0, 0, 0, 0, 0, 0, 0, 
 	0, 0, 0, 0, 0, 0, 0, 0, 
@@ -1026,7 +1124,14 @@ static const char _indic_syllable_machine_from_state_actions[] = {
 	0, 0, 0, 0, 0, 0, 0, 0, 
 	0, 0, 0, 0, 0, 0, 0, 0, 
 	0, 0, 0, 0, 0, 0, 0, 0, 
-	0, 0, 0, 0, 0, 0, 0, 9, 
+	0, 0, 0, 0, 0, 0, 0, 0, 
+	0, 0, 0, 0, 0, 0, 0, 0, 
+	0, 0, 0, 0, 0, 0, 0, 0, 
+	0, 0, 0, 0, 0, 0, 0, 0, 
+	0, 0, 10, 0, 0, 0, 0, 0, 
+	0, 0, 0, 0, 0, 0, 0, 0, 
+	0, 0, 0, 0, 0, 0, 0, 0, 
+	0, 0, 0, 0, 0, 0, 0, 0, 
 	0, 0, 0, 0, 0, 0, 0, 0, 
 	0, 0, 0, 0, 0, 0, 0, 0, 
 	0, 0, 0, 0, 0, 0, 0, 0, 
@@ -1081,56 +1186,63 @@ static const short _indic_syllable_machine_eof_trans[] = {
 	77, 77, 77, 77, 77, 77, 77, 77, 
 	77, 77, 77, 77, 77, 77, 77, 77, 
 	77, 77, 77, 77, 77, 77, 77, 77, 
-	77, 77, 77, 115, 115, 115, 115, 115, 
+	83, 77, 77, 115, 115, 115, 115, 115, 
 	115, 115, 115, 115, 115, 115, 115, 115, 
 	115, 115, 115, 115, 115, 115, 115, 115, 
 	115, 115, 115, 115, 115, 115, 115, 115, 
-	115, 115, 115, 115, 115, 115, 115, 0, 
-	167, 167, 167, 167, 167, 167, 167, 167, 
-	167, 167, 167, 167, 167, 167, 167, 167, 
-	167, 167, 167, 167, 167, 167, 167, 167, 
-	167, 167, 167, 167, 167, 167, 167, 167, 
-	167, 167, 167, 167, 167, 167, 167, 167, 
-	167, 167, 167, 167, 167, 167, 167, 167, 
-	167, 167, 167, 167, 167, 167, 167, 167, 
-	167, 167, 167, 167, 167, 167, 167, 167, 
-	167, 167, 167, 167, 167, 167, 167, 167, 
-	167, 167, 167, 242, 242, 242, 242, 242, 
-	242, 242, 242, 242, 242, 242, 242, 242, 
-	242, 242, 242, 242, 242, 242, 242, 242, 
-	242, 242, 242, 242, 242, 242, 242, 242, 
-	242, 242, 242, 242, 242, 242, 242, 242, 
-	242, 242, 242, 242, 242, 242, 242, 242, 
-	242, 242, 242, 242, 242, 242, 242, 242, 
-	242, 242, 242, 242, 242, 242, 242, 242, 
-	242, 242, 242, 242, 242, 242, 242, 242, 
-	242, 242, 242, 242, 242, 316, 316, 316, 
-	316, 316, 316, 316, 316, 316, 316, 316, 
-	316, 316, 316, 316, 316, 316, 316, 316, 
-	316, 316, 316, 316, 316, 316, 316, 316, 
-	316, 316, 316, 316, 316, 316, 316, 316, 
-	316, 316, 316, 316, 316, 316, 316, 316, 
-	316, 316, 316, 316, 316, 316, 316, 316, 
-	316, 316, 316, 316, 316, 316, 316, 316, 
-	316, 316, 316, 316, 316, 316, 316, 316, 
-	316, 316, 316, 316, 383, 316, 383, 384, 
-	384, 384, 384, 384, 384, 384, 384, 384, 
-	384, 384, 384, 384, 384, 384, 384, 384, 
-	384, 384, 384, 384, 384, 384, 384, 384, 
-	384, 384, 384, 384, 384, 384, 384, 384, 
-	384, 384, 384, 384, 384, 384, 384, 384, 
-	384, 384, 384, 384, 384, 384, 384, 384, 
-	384, 384, 384, 384, 384, 384, 384, 384, 
-	384, 384, 384, 384, 384, 384, 384, 384, 
-	384, 384, 384, 384, 384, 384, 384, 384, 
-	383, 167, 167
+	115, 115, 115, 115, 115, 115, 115, 77, 
+	1, 1, 1, 1, 1, 1, 1, 1, 
+	1, 1, 1, 1, 1, 1, 1, 1, 
+	1, 1, 1, 1, 1, 1, 1, 1, 
+	1, 1, 0, 194, 194, 194, 194, 194, 
+	194, 194, 194, 194, 194, 194, 194, 194, 
+	194, 194, 194, 194, 194, 194, 194, 194, 
+	194, 194, 194, 194, 194, 194, 194, 194, 
+	194, 194, 194, 194, 194, 194, 194, 194, 
+	194, 194, 194, 194, 194, 194, 194, 194, 
+	194, 194, 194, 194, 194, 194, 194, 194, 
+	194, 194, 194, 194, 194, 194, 194, 194, 
+	194, 194, 194, 194, 194, 194, 194, 194, 
+	194, 194, 194, 194, 194, 194, 269, 269, 
+	269, 269, 269, 269, 269, 269, 269, 269, 
+	269, 269, 269, 269, 269, 269, 269, 269, 
+	269, 269, 269, 269, 269, 269, 269, 269, 
+	269, 269, 269, 269, 269, 269, 269, 269, 
+	269, 269, 269, 269, 269, 269, 269, 269, 
+	269, 269, 269, 269, 269, 269, 269, 269, 
+	269, 269, 269, 269, 269, 269, 269, 269, 
+	269, 269, 269, 269, 269, 269, 269, 269, 
+	269, 269, 269, 269, 269, 269, 269, 269, 
+	343, 343, 343, 343, 343, 343, 343, 343, 
+	343, 343, 343, 343, 343, 343, 343, 343, 
+	343, 343, 343, 343, 343, 343, 343, 343, 
+	343, 343, 343, 343, 343, 343, 343, 343, 
+	343, 343, 343, 343, 343, 343, 343, 343, 
+	343, 343, 343, 343, 343, 343, 343, 343, 
+	343, 343, 343, 343, 343, 343, 343, 343, 
+	343, 343, 343, 343, 343, 343, 343, 343, 
+	343, 343, 343, 343, 343, 343, 343, 410, 
+	343, 410, 411, 411, 411, 411, 411, 411, 
+	411, 411, 411, 411, 411, 411, 411, 411, 
+	411, 411, 411, 411, 411, 411, 411, 411, 
+	411, 411, 411, 411, 411, 411, 411, 411, 
+	411, 411, 411, 411, 411, 411, 411, 411, 
+	411, 411, 411, 411, 411, 411, 411, 411, 
+	411, 411, 411, 411, 411, 411, 411, 411, 
+	411, 411, 411, 411, 411, 411, 411, 411, 
+	411, 411, 411, 411, 411, 411, 411, 411, 
+	411, 411, 411, 343, 194, 194, 194, 343, 
+	194, 194, 194, 194, 194, 194, 194, 194, 
+	194, 194, 194, 194, 194, 194, 194, 194, 
+	194, 194, 194, 194, 194, 194, 194, 194, 
+	194, 194, 343
 };
 
-static const int indic_syllable_machine_start = 143;
-static const int indic_syllable_machine_first_final = 143;
+static const int indic_syllable_machine_start = 170;
+static const int indic_syllable_machine_first_final = 170;
 static const int indic_syllable_machine_error = -1;
 
-static const int indic_syllable_machine_en_main = 143;
+static const int indic_syllable_machine_en_main = 170;
 
 
 #line 36 "../../src/hb-ot-shape-complex-indic-machine.rl"
@@ -1153,11 +1265,11 @@ static const int indic_syllable_machine_en_main = 143;
 static void
 find_syllables (hb_buffer_t *buffer)
 {
-  unsigned int p, pe, eof, ts, te, act;
+  unsigned int p, pe, eof, ts HB_UNUSED, te, act;
   int cs;
   hb_glyph_info_t *info = buffer->info;
   
-#line 1161 "../../src/hb-ot-shape-complex-indic-machine.hh.tmp"
+#line 1273 "../../src/hb-ot-shape-complex-indic-machine.hh.tmp"
 	{
 	cs = indic_syllable_machine_start;
 	ts = 0;
@@ -1174,7 +1286,7 @@ find_syllables (hb_buffer_t *buffer)
   unsigned int last = 0;
   unsigned int syllable_serial = 1;
   
-#line 1178 "../../src/hb-ot-shape-complex-indic-machine.hh.tmp"
+#line 1290 "../../src/hb-ot-shape-complex-indic-machine.hh.tmp"
 	{
 	int _slen;
 	int _trans;
@@ -1184,11 +1296,11 @@ find_syllables (hb_buffer_t *buffer)
 		goto _test_eof;
 _resume:
 	switch ( _indic_syllable_machine_from_state_actions[cs] ) {
-	case 9:
+	case 10:
 #line 1 "NONE"
 	{ts = p;}
 	break;
-#line 1192 "../../src/hb-ot-shape-complex-indic-machine.hh.tmp"
+#line 1304 "../../src/hb-ot-shape-complex-indic-machine.hh.tmp"
 	}
 
 	_keys = _indic_syllable_machine_trans_keys + (cs<<1);
@@ -1210,43 +1322,43 @@ _eof_trans:
 #line 1 "NONE"
 	{te = p+1;}
 	break;
-	case 13:
+	case 14:
 #line 83 "../../src/hb-ot-shape-complex-indic-machine.rl"
 	{te = p+1;{ found_syllable (consonant_syllable); }}
 	break;
-	case 15:
+	case 16:
 #line 84 "../../src/hb-ot-shape-complex-indic-machine.rl"
 	{te = p+1;{ found_syllable (vowel_syllable); }}
 	break;
-	case 20:
+	case 21:
 #line 85 "../../src/hb-ot-shape-complex-indic-machine.rl"
 	{te = p+1;{ found_syllable (standalone_cluster); }}
 	break;
-	case 17:
+	case 18:
 #line 86 "../../src/hb-ot-shape-complex-indic-machine.rl"
 	{te = p+1;{ found_syllable (broken_cluster); }}
 	break;
-	case 10:
+	case 11:
 #line 87 "../../src/hb-ot-shape-complex-indic-machine.rl"
 	{te = p+1;{ found_syllable (non_indic_cluster); }}
 	break;
-	case 12:
+	case 13:
 #line 83 "../../src/hb-ot-shape-complex-indic-machine.rl"
 	{te = p;p--;{ found_syllable (consonant_syllable); }}
 	break;
-	case 14:
+	case 15:
 #line 84 "../../src/hb-ot-shape-complex-indic-machine.rl"
 	{te = p;p--;{ found_syllable (vowel_syllable); }}
 	break;
-	case 19:
+	case 20:
 #line 85 "../../src/hb-ot-shape-complex-indic-machine.rl"
 	{te = p;p--;{ found_syllable (standalone_cluster); }}
 	break;
-	case 16:
+	case 17:
 #line 86 "../../src/hb-ot-shape-complex-indic-machine.rl"
 	{te = p;p--;{ found_syllable (broken_cluster); }}
 	break;
-	case 18:
+	case 19:
 #line 87 "../../src/hb-ot-shape-complex-indic-machine.rl"
 	{te = p;p--;{ found_syllable (non_indic_cluster); }}
 	break;
@@ -1269,6 +1381,9 @@ _eof_trans:
 	case 5:
 #line 1 "NONE"
 	{	switch( act ) {
+	case 1:
+	{{p = ((te))-1;} found_syllable (consonant_syllable); }
+	break;
 	case 4:
 	{{p = ((te))-1;} found_syllable (broken_cluster); }
 	break;
@@ -1278,28 +1393,34 @@ _eof_trans:
 	}
 	}
 	break;
+	case 8:
+#line 1 "NONE"
+	{te = p+1;}
+#line 83 "../../src/hb-ot-shape-complex-indic-machine.rl"
+	{act = 1;}
+	break;
 	case 6:
 #line 1 "NONE"
 	{te = p+1;}
 #line 86 "../../src/hb-ot-shape-complex-indic-machine.rl"
 	{act = 4;}
 	break;
-	case 11:
+	case 12:
 #line 1 "NONE"
 	{te = p+1;}
 #line 87 "../../src/hb-ot-shape-complex-indic-machine.rl"
 	{act = 5;}
 	break;
-#line 1294 "../../src/hb-ot-shape-complex-indic-machine.hh.tmp"
+#line 1415 "../../src/hb-ot-shape-complex-indic-machine.hh.tmp"
 	}
 
 _again:
 	switch ( _indic_syllable_machine_to_state_actions[cs] ) {
-	case 8:
+	case 9:
 #line 1 "NONE"
 	{ts = 0;}
 	break;
-#line 1303 "../../src/hb-ot-shape-complex-indic-machine.hh.tmp"
+#line 1424 "../../src/hb-ot-shape-complex-indic-machine.hh.tmp"
 	}
 
 	if ( ++p != pe )
diff --git a/gfx/harfbuzz/src/hb-ot-shape-complex-indic-machine.rl b/gfx/harfbuzz/src/hb-ot-shape-complex-indic-machine.rl
index a536da55cff7..11115c9cda47 100644
--- a/gfx/harfbuzz/src/hb-ot-shape-complex-indic-machine.rl
+++ b/gfx/harfbuzz/src/hb-ot-shape-complex-indic-machine.rl
@@ -76,7 +76,7 @@ halant_or_matra_group = (final_halant_group | (h.ZWJ)? matra_group{0,4});
 consonant_syllable =	Repha? (cn.halant_group){0,4} cn A? halant_or_matra_group? syllable_tail;
 vowel_syllable =	reph? V.n? (ZWJ | (halant_group.cn){0,4} halant_or_matra_group? syllable_tail);
 standalone_cluster =	reph? place_holder.n? (halant_group.cn){0,4} halant_or_matra_group? syllable_tail;
-broken_cluster =	n? (halant_group.cn){0,4} halant_or_matra_group syllable_tail;
+broken_cluster =	reph? n? (halant_group.cn){0,4} halant_or_matra_group syllable_tail;
 other =			any;
 
 main := |*
@@ -103,7 +103,7 @@ main := |*
 static void
 find_syllables (hb_buffer_t *buffer)
 {
-  unsigned int p, pe, eof, ts, te, act;
+  unsigned int p, pe, eof, ts HB_UNUSED, te, act;
   int cs;
   hb_glyph_info_t *info = buffer->info;
   %%{
diff --git a/gfx/harfbuzz/src/hb-ot-shape-complex-indic-table.hh b/gfx/harfbuzz/src/hb-ot-shape-complex-indic-table.hh
index 5b4b3445df28..70765b6d6f40 100644
--- a/gfx/harfbuzz/src/hb-ot-shape-complex-indic-table.hh
+++ b/gfx/harfbuzz/src/hb-ot-shape-complex-indic-table.hh
@@ -6,12 +6,12 @@
  *
  * on files with these headers:
  *
- * # IndicSyllabicCategory-6.1.0.txt
- * # Date: 2011-08-31, 23:54:00 GMT [KW]
- * # IndicMatraCategory-6.1.0.txt
- * # Date: 2011-08-31, 23:50:00 GMT [KW]
- * # Blocks-6.1.0.txt
- * # Date: 2011-06-14, 18:26:00 GMT [KW, LI]
+ * # IndicSyllabicCategory-6.2.0.txt
+ * # Date: 2012-05-15, 21:12:00 GMT [KW]
+ * # IndicMatraCategory-6.2.0.txt
+ * # Date: 2012-05-15, 21:10:00 GMT [KW]
+ * # Blocks-6.2.0.txt
+ * # Date: 2012-05-14, 22:42:00 GMT [KW, LI]
  */
 
 #ifndef HB_OT_SHAPE_COMPLEX_INDIC_TABLE_HH
diff --git a/gfx/harfbuzz/src/hb-ot-shape-complex-indic.cc b/gfx/harfbuzz/src/hb-ot-shape-complex-indic.cc
index d924d1a5a922..1bc8a773e315 100644
--- a/gfx/harfbuzz/src/hb-ot-shape-complex-indic.cc
+++ b/gfx/harfbuzz/src/hb-ot-shape-complex-indic.cc
@@ -124,7 +124,7 @@ static const indic_config_t indic_configs[] =
   {HB_SCRIPT_SINHALA,	false,0x0DCA,BASE_POS_FIRST,REPH_POS_AFTER_MAIN, REPH_MODE_EXPLICIT},
   {HB_SCRIPT_KHMER,	false,0x17D2,BASE_POS_FIRST,REPH_POS_DEFAULT,    REPH_MODE_VIS_REPHA},
   /* Myanmar does not have the "old_indic" behavior, even though it has a "new" tag. */
-  {HB_SCRIPT_MYANMAR,	false, 0x1039,BASE_POS_LAST, REPH_POS_DEFAULT,    REPH_MODE_EXPLICIT},
+  {HB_SCRIPT_MYANMAR,	false,0x1039,BASE_POS_LAST, REPH_POS_DEFAULT,    REPH_MODE_EXPLICIT},
 };
 
 
@@ -467,7 +467,7 @@ initial_reordering_consonant_syllable (const hb_ot_shape_plan_t *plan,
     unsigned int limit = start;
     if (indic_plan->mask_array[RPHF] &&
 	start + 3 <= end &&
-	(/* TODO Handle other Reph modes. */
+	(
 	 (indic_plan->config->reph_mode == REPH_MODE_IMPLICIT && !is_joiner (info[start + 2])) ||
 	 (indic_plan->config->reph_mode == REPH_MODE_EXPLICIT && info[start + 2].indic_category() == OT_ZWJ)
 	))
@@ -482,7 +482,14 @@ initial_reordering_consonant_syllable (const hb_ot_shape_plan_t *plan,
 	base = start;
 	has_reph = true;
       }
-    };
+    } else if (indic_plan->config->reph_mode == REPH_MODE_LOG_REPHA && info[start].indic_category() == OT_Repha)
+    {
+	limit += 1;
+	while (limit < end && is_joiner (info[limit]))
+	  limit++;
+	base = start;
+	has_reph = true;
+    }
 
     switch (indic_plan->config->base_pos)
     {
@@ -570,7 +577,7 @@ initial_reordering_consonant_syllable (const hb_ot_shape_plan_t *plan,
      *    base consonants.
      *
      *  Only do this for unforced Reph. (ie. not for Ra,H,ZWJ. */
-    if (has_reph && base == start && start + 2 == limit) {
+    if (has_reph && base == start && start - limit <= 2) {
       /* Have no other consonant, so Reph is not formed and Ra becomes base. */
       has_reph = false;
     }
@@ -852,7 +859,7 @@ initial_reordering_syllable (const hb_ot_shape_plan_t *plan,
 }
 
 static inline void
-insert_dotted_circles (const hb_ot_shape_plan_t *plan,
+insert_dotted_circles (const hb_ot_shape_plan_t *plan HB_UNUSED,
 		       hb_font_t *font,
 		       hb_buffer_t *buffer)
 {
@@ -887,14 +894,23 @@ insert_dotted_circles (const hb_ot_shape_plan_t *plan,
     syllable_type_t syllable_type = (syllable_type_t) (syllable & 0x0F);
     if (unlikely (last_syllable != syllable && syllable_type == broken_cluster))
     {
+      last_syllable = syllable;
+
       hb_glyph_info_t info = dottedcircle;
       info.cluster = buffer->cur().cluster;
       info.mask = buffer->cur().mask;
       info.syllable() = buffer->cur().syllable();
+
+      /* Insert dottedcircle after possible Repha. */
+      while (buffer->idx < buffer->len &&
+	     last_syllable == buffer->cur().syllable() &&
+	     buffer->cur().indic_category() == OT_Repha)
+        buffer->next_glyph ();
+
       buffer->output_info (info);
-      last_syllable = syllable;
     }
-    buffer->next_glyph ();
+    else
+      buffer->next_glyph ();
   }
 
   buffer->swap_buffers ();
@@ -1246,7 +1262,7 @@ final_reordering_syllable (const hb_ot_shape_plan_t *plan,
 
 static void
 final_reordering (const hb_ot_shape_plan_t *plan,
-		  hb_font_t *font,
+		  hb_font_t *font HB_UNUSED,
 		  hb_buffer_t *buffer)
 {
   unsigned int count = buffer->len;
@@ -1273,7 +1289,7 @@ final_reordering (const hb_ot_shape_plan_t *plan,
 
 
 static hb_ot_shape_normalization_mode_t
-normalization_preference_indic (const hb_segment_properties_t *props)
+normalization_preference_indic (const hb_segment_properties_t *props HB_UNUSED)
 {
   return HB_OT_SHAPE_NORMALIZATION_MODE_COMPOSED_DIACRITICS_NO_SHORT_CIRCUIT;
 }
@@ -1338,6 +1354,11 @@ decompose_indic (const hb_ot_shape_normalize_context_t *c,
      * don't have positioning features for the Unicode-style decomposition.
      *
      * Argh...
+     *
+     * The Uniscribe behavior is now documented in the newly published Sinhala
+     * spec in 2012:
+     *
+     *   http://www.microsoft.com/typography/OpenTypeDev/sinhala/intro.htm#shaping
      */
 
     const indic_shape_plan_t *indic_plan = (const indic_shape_plan_t *) c->plan->data;
diff --git a/gfx/harfbuzz/src/hb-ot-shape-complex-private.hh b/gfx/harfbuzz/src/hb-ot-shape-complex-private.hh
index 1ed2df78c316..26871c2fc09d 100644
--- a/gfx/harfbuzz/src/hb-ot-shape-complex-private.hh
+++ b/gfx/harfbuzz/src/hb-ot-shape-complex-private.hh
@@ -283,24 +283,22 @@ hb_ot_shape_complex_categorize (const hb_ot_shape_planner_t *planner)
       else
 	return &_hb_ot_complex_shaper_default;
 
-
     case HB_SCRIPT_KHMER:
       /* A number of Khmer fonts in the wild don't have a 'pref' feature,
        * and as such won't shape properly via the Indic shaper;
        * however, they typically have 'liga' / 'clig' features that implement
        * the necessary "reordering" by means of ligature substitutions.
-       * So we send such pref-less fonts through the generic shaper instead;
-       * use Indic only if the 'khmr' script has the 'pref' feature. */
+       * So we send such pref-less fonts through the generic shaper instead. */
       if (planner->map.found_script[0] &&
 	  hb_ot_layout_language_find_feature (planner->face, HB_OT_TAG_GSUB,
 					      planner->map.script_index[0],
 					      planner->map.language_index[0],
-					      HB_TAG ('p','r','e','f'), NULL))
+					      HB_TAG ('p','r','e','f'),
+					      NULL))
 	return &_hb_ot_complex_shaper_indic;
       else
 	return &_hb_ot_complex_shaper_default;
 
-
     case HB_SCRIPT_MYANMAR:
       /* For Myanmar, we only want to use the Indic shaper if the "new" script
        * tag is found.  For "old" script tag we want to use the default shaper. */
diff --git a/gfx/harfbuzz/src/hb-ot-shape-complex-thai.cc b/gfx/harfbuzz/src/hb-ot-shape-complex-thai.cc
index 076089181102..24d476a0ba30 100644
--- a/gfx/harfbuzz/src/hb-ot-shape-complex-thai.cc
+++ b/gfx/harfbuzz/src/hb-ot-shape-complex-thai.cc
@@ -215,7 +215,7 @@ static const struct thai_below_state_machine_edge_t {
 
 
 static void
-do_thai_pua_shaping (const hb_ot_shape_plan_t *plan,
+do_thai_pua_shaping (const hb_ot_shape_plan_t *plan HB_UNUSED,
 		     hb_buffer_t              *buffer,
 		     hb_font_t                *font)
 {
diff --git a/gfx/harfbuzz/src/hb-ot-shape-fallback.cc b/gfx/harfbuzz/src/hb-ot-shape-fallback.cc
index f4463e4eeca3..6f3426e6b490 100644
--- a/gfx/harfbuzz/src/hb-ot-shape-fallback.cc
+++ b/gfx/harfbuzz/src/hb-ot-shape-fallback.cc
@@ -161,8 +161,8 @@ recategorize_combining_class (hb_codepoint_t u,
 }
 
 void
-_hb_ot_shape_fallback_position_recategorize_marks (const hb_ot_shape_plan_t *plan,
-						   hb_font_t *font,
+_hb_ot_shape_fallback_position_recategorize_marks (const hb_ot_shape_plan_t *plan HB_UNUSED,
+						   hb_font_t *font HB_UNUSED,
 						   hb_buffer_t  *buffer)
 {
   unsigned int count = buffer->len;
diff --git a/gfx/harfbuzz/src/hb-ot-shape.cc b/gfx/harfbuzz/src/hb-ot-shape.cc
index 86011278e803..96461d7079e3 100644
--- a/gfx/harfbuzz/src/hb-ot-shape.cc
+++ b/gfx/harfbuzz/src/hb-ot-shape.cc
@@ -348,8 +348,8 @@ hb_synthesize_glyph_classes (hb_ot_shape_context_t *c)
   unsigned int count = c->buffer->len;
   for (unsigned int i = 0; i < count; i++)
     c->buffer->info[i].glyph_props() = _hb_glyph_info_get_general_category (&c->buffer->info[i]) == HB_UNICODE_GENERAL_CATEGORY_NON_SPACING_MARK ?
-				       HB_OT_LAYOUT_GLYPH_CLASS_MARK :
-				       HB_OT_LAYOUT_GLYPH_CLASS_BASE_GLYPH;
+				       HB_OT_LAYOUT_GLYPH_PROPS_MARK :
+				       HB_OT_LAYOUT_GLYPH_PROPS_BASE_GLYPH;
 }
 
 static inline void
@@ -577,6 +577,7 @@ hb_ot_shape_plan_collect_lookups (hb_shape_plan_t *shape_plan,
 				  hb_tag_t         table_tag,
 				  hb_set_t        *lookup_indexes /* OUT */)
 {
+  /* XXX Does the first part always succeed? */
   HB_SHAPER_DATA_GET (shape_plan)->collect_lookups (table_tag, lookup_indexes);
 }
 
diff --git a/gfx/harfbuzz/src/hb-ot-tag.cc b/gfx/harfbuzz/src/hb-ot-tag.cc
index 0004a7536472..91ebec76ee38 100644
--- a/gfx/harfbuzz/src/hb-ot-tag.cc
+++ b/gfx/harfbuzz/src/hb-ot-tag.cc
@@ -23,7 +23,7 @@
  * PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
  *
  * Red Hat Author(s): Behdad Esfahbod
- * Google Author(s): Behdad Esfahbod
+ * Google Author(s): Behdad Esfahbod, Roozbeh Pournader
  */
 
 #include "hb-private.hh"
@@ -169,7 +169,9 @@ typedef struct {
  * Draft OpenType 1.5 spec, with with the ISO 639-3 codes from
  * 2008/08/04, matching on name, and finally adjusted manually.
  *
- * Many items still missing.  Those are commented out at the end.
+ * Updated on 2012/12/07 with more research into remaining codes.
+ *
+ * Some items still missing.  Those are commented out at the end.
  * Keep sorted for bsearch.
  */
 
@@ -177,43 +179,63 @@ static const LangTag ot_languages[] = {
   {"aa",	HB_TAG('A','F','R',' ')},	/* Afar */
   {"ab",	HB_TAG('A','B','K',' ')},	/* Abkhazian */
   {"abq",	HB_TAG('A','B','A',' ')},	/* Abaza */
+  {"ada",	HB_TAG('D','N','G',' ')},	/* Dangme */
   {"ady",	HB_TAG('A','D','Y',' ')},	/* Adyghe */
   {"af",	HB_TAG('A','F','K',' ')},	/* Afrikaans */
+  {"aii",	HB_TAG('S','W','A',' ')},	/* Swadaya Aramaic */
   {"aiw",	HB_TAG('A','R','I',' ')},	/* Aari */
+  {"alt",	HB_TAG('A','L','T',' ')},	/* [Southern] Altai */
   {"am",	HB_TAG('A','M','H',' ')},	/* Amharic */
+  {"amf",	HB_TAG('H','B','N',' ')},	/* Hammer-Banna */
   {"ar",	HB_TAG('A','R','A',' ')},	/* Arabic */
   {"arn",	HB_TAG('M','A','P',' ')},	/* Mapudungun */
   {"as",	HB_TAG('A','S','M',' ')},	/* Assamese */
+  {"ath",	HB_TAG('A','T','H',' ')},	/* Athapaskan [family] */
+  {"atv",	HB_TAG('A','L','T',' ')},	/* [Northern] Altai */
   {"av",	HB_TAG('A','V','R',' ')},	/* Avaric */
   {"awa",	HB_TAG('A','W','A',' ')},	/* Awadhi */
   {"ay",	HB_TAG('A','Y','M',' ')},	/* Aymara */
   {"az",	HB_TAG('A','Z','E',' ')},	/* Azerbaijani */
   {"ba",	HB_TAG('B','S','H',' ')},	/* Bashkir */
+  {"bai",	HB_TAG('B','M','L',' ')},	/* Bamileke [family] */
   {"bal",	HB_TAG('B','L','I',' ')},	/* Baluchi */
+  {"bci",	HB_TAG('B','A','U',' ')},	/* Baule */
   {"bcq",	HB_TAG('B','C','H',' ')},	/* Bench */
+  {"be",	HB_TAG('B','E','L',' ')},  	/* Belarussian */
   {"bem",	HB_TAG('B','E','M',' ')},	/* Bemba (Zambia) */
+  {"ber",	HB_TAG('B','E','R',' ')},  	/* Berber [family] */
   {"bfq",	HB_TAG('B','A','D',' ')},	/* Badaga */
   {"bft",	HB_TAG('B','L','T',' ')},	/* Balti */
+  {"bfy",	HB_TAG('B','A','G',' ')},	/* Baghelkhandi */
   {"bg",	HB_TAG('B','G','R',' ')},	/* Bulgarian */
   {"bhb",	HB_TAG('B','H','I',' ')},	/* Bhili */
   {"bho",	HB_TAG('B','H','O',' ')},	/* Bhojpuri */
   {"bik",	HB_TAG('B','I','K',' ')},	/* Bikol */
   {"bin",	HB_TAG('E','D','O',' ')},	/* Bini */
+  {"bjt",	HB_TAG('B','L','N',' ')},	/* Balanta-Ganja */
+  {"bla",	HB_TAG('B','K','F',' ')},	/* Blackfoot */
+  {"ble",	HB_TAG('B','L','N',' ')},	/* Balanta-Kentohe */
   {"bm",	HB_TAG('B','M','B',' ')},	/* Bambara */
   {"bn",	HB_TAG('B','E','N',' ')},	/* Bengali */
   {"bo",	HB_TAG('T','I','B',' ')},	/* Tibetan */
   {"br",	HB_TAG('B','R','E',' ')},	/* Breton */
+  {"bra",	HB_TAG('B','R','I',' ')},	/* Braj Bhasha */
   {"brh",	HB_TAG('B','R','H',' ')},	/* Brahui */
   {"bs",	HB_TAG('B','O','S',' ')},	/* Bosnian */
   {"btb",	HB_TAG('B','T','I',' ')},	/* Beti (Cameroon) */
+  {"bxr",	HB_TAG('R','B','U',' ')},	/* Russian Buriat */
+  {"byn",	HB_TAG('B','I','L',' ')},	/* Bilen */
   {"ca",	HB_TAG('C','A','T',' ')},	/* Catalan */
   {"ce",	HB_TAG('C','H','E',' ')},	/* Chechen */
   {"ceb",	HB_TAG('C','E','B',' ')},	/* Cebuano */
   {"chp",	HB_TAG('C','H','P',' ')},	/* Chipewyan */
   {"chr",	HB_TAG('C','H','R',' ')},	/* Cherokee */
+  {"ckt",	HB_TAG('C','H','K',' ')},	/* Chukchi */
   {"cop",	HB_TAG('C','O','P',' ')},	/* Coptic */
   {"cr",	HB_TAG('C','R','E',' ')},	/* Cree */
   {"crh",	HB_TAG('C','R','T',' ')},	/* Crimean Tatar */
+  {"crj",	HB_TAG('E','C','R',' ')},	/* [Southern] East Cree */
+  {"crl",	HB_TAG('E','C','R',' ')},	/* [Northern] East Cree */
   {"crm",	HB_TAG('M','C','R',' ')},	/* Moose Cree */
   {"crx",	HB_TAG('C','R','R',' ')},	/* Carrier */
   {"cs",	HB_TAG('C','S','Y',' ')},	/* Czech */
@@ -226,10 +248,12 @@ static const LangTag ot_languages[] = {
   {"dar",	HB_TAG('D','A','R',' ')},	/* Dargwa */
   {"de",	HB_TAG('D','E','U',' ')},	/* German */
   {"din",	HB_TAG('D','N','K',' ')},	/* Dinka */
+  {"dje",	HB_TAG('D','J','R',' ')},	/* Djerma */
   {"dng",	HB_TAG('D','U','N',' ')},	/* Dungan */
   {"doi",	HB_TAG('D','G','R',' ')},	/* Dogri */
   {"dsb",	HB_TAG('L','S','B',' ')},	/* Lower Sorbian */
   {"dv",	HB_TAG('D','I','V',' ')},	/* Dhivehi */
+  {"dyu",	HB_TAG('J','U','L',' ')},	/* Jula */
   {"dz",	HB_TAG('D','Z','N',' ')},	/* Dzongkha */
   {"ee",	HB_TAG('E','W','E',' ')},	/* Ewe */
   {"efi",	HB_TAG('E','F','I',' ')},	/* Efik */
@@ -257,20 +281,27 @@ static const LangTag ot_languages[] = {
   {"gag",	HB_TAG('G','A','G',' ')},	/* Gagauz */
   {"gbm",	HB_TAG('G','A','W',' ')},	/* Garhwali */
   {"gd",	HB_TAG('G','A','E',' ')},	/* Scottish Gaelic */
+  {"gez",	HB_TAG('G','E','Z',' ')},	/* Ge'ez */
   {"gl",	HB_TAG('G','A','L',' ')},	/* Galician */
   {"gld",	HB_TAG('N','A','N',' ')},	/* Nanai */
   {"gn",	HB_TAG('G','U','A',' ')},	/* Guarani */
   {"gon",	HB_TAG('G','O','N',' ')},	/* Gondi */
   {"grt",	HB_TAG('G','R','O',' ')},	/* Garo */
+  {"gru",	HB_TAG('S','O','G',' ')},	/* Sodo Gurage */
   {"gu",	HB_TAG('G','U','J',' ')},	/* Gujarati */
   {"guk",	HB_TAG('G','M','Z',' ')},	/* Gumuz */
   {"gv",	HB_TAG('M','N','X',' ')},	/* Manx Gaelic */
   {"ha",	HB_TAG('H','A','U',' ')},	/* Hausa */
   {"har",	HB_TAG('H','R','I',' ')},	/* Harari */
+  {"haw",	HB_TAG('H','A','W',' ')},  	/* Hawaiin */
   {"he",	HB_TAG('I','W','R',' ')},	/* Hebrew */
   {"hi",	HB_TAG('H','I','N',' ')},	/* Hindi */
   {"hil",	HB_TAG('H','I','L',' ')},	/* Hiligaynon */
+  {"hnd",	HB_TAG('H','N','D',' ')},	/* [Southern] Hindko */
+  {"hne",	HB_TAG('C','H','H',' ')},	/* Chattisgarhi */
+  {"hno",	HB_TAG('H','N','D',' ')},	/* [Northern] Hindko */
   {"hoc",	HB_TAG('H','O',' ',' ')},	/* Ho */
+  {"hoj",	HB_TAG('H','A','R',' ')},	/* Harauti */
   {"hr",	HB_TAG('H','R','V',' ')},	/* Croatian */
   {"hsb",	HB_TAG('U','S','B',' ')},	/* Upper Sorbian */
   {"ht",	HB_TAG('H','A','I',' ')},	/* Haitian */
@@ -279,6 +310,8 @@ static const LangTag ot_languages[] = {
   {"id",	HB_TAG('I','N','D',' ')},	/* Indonesian */
   {"ig",	HB_TAG('I','B','O',' ')},	/* Igbo */
   {"igb",	HB_TAG('E','B','I',' ')},	/* Ebira */
+  {"ijo",	HB_TAG('I','J','O',' ')},	/* Ijo [family] */
+  {"ilo",	HB_TAG('I','L','O',' ')},	/* Ilokano */
   {"inh",	HB_TAG('I','N','G',' ')},	/* Ingush */
   {"is",	HB_TAG('I','S','L',' ')},	/* Icelandic */
   {"it",	HB_TAG('I','T','A',' ')},	/* Italian */
@@ -286,19 +319,25 @@ static const LangTag ot_languages[] = {
   {"ja",	HB_TAG('J','A','N',' ')},	/* Japanese */
   {"jv",	HB_TAG('J','A','V',' ')},	/* Javanese */
   {"ka",	HB_TAG('K','A','T',' ')},	/* Georgian */
+  {"kaa",	HB_TAG('K','R','K',' ')},	/* Karakalpak */
   {"kam",	HB_TAG('K','M','B',' ')},	/* Kamba (Kenya) */
+  {"kar",	HB_TAG('K','R','N',' ')},	/* Karen [family] */
   {"kbd",	HB_TAG('K','A','B',' ')},	/* Kabardian */
   {"kdr",	HB_TAG('K','R','M',' ')},	/* Karaim */
   {"kdt",	HB_TAG('K','U','Y',' ')},	/* Kuy */
+  {"kex",	HB_TAG('K','K','N',' ')},	/* Kokni */
   {"kfr",	HB_TAG('K','A','C',' ')},	/* Kachchi */
   {"kfy",	HB_TAG('K','M','N',' ')},	/* Kumaoni */
   {"kha",	HB_TAG('K','S','I',' ')},	/* Khasi */
+  {"khb",	HB_TAG('X','B','D',' ')},	/* Tai Lue */
   {"khw",	HB_TAG('K','H','W',' ')},	/* Khowar */
   {"ki",	HB_TAG('K','I','K',' ')},	/* Kikuyu */
+  {"kjh",	HB_TAG('K','H','A',' ')},	/* Khakass */
   {"kk",	HB_TAG('K','A','Z',' ')},	/* Kazakh */
   {"kl",	HB_TAG('G','R','N',' ')},	/* Kalaallisut */
   {"kln",	HB_TAG('K','A','L',' ')},	/* Kalenjin */
   {"km",	HB_TAG('K','H','M',' ')},	/* Central Khmer */
+  {"kmb",	HB_TAG('M','B','N',' ')},	/* [North] Mbundu */
   {"kmw",	HB_TAG('K','M','O',' ')},	/* Komo (Democratic Republic of Congo) */
   {"kn",	HB_TAG('K','A','N',' ')},	/* Kannada */
   {"ko",	HB_TAG('K','O','R',' ')},	/* Korean */
@@ -316,6 +355,7 @@ static const LangTag ot_languages[] = {
   {"ku",	HB_TAG('K','U','R',' ')},	/* Kurdish */
   {"kum",	HB_TAG('K','U','M',' ')},	/* Kumyk */
   {"kvd",	HB_TAG('K','U','I',' ')},	/* Kui (Indonesia) */
+  {"kxc",	HB_TAG('K','M','S',' ')},	/* Komso */
   {"kxu",	HB_TAG('K','U','I',' ')},	/* Kui (India) */
   {"ky",	HB_TAG('K','I','R',' ')},	/* Kirghiz */
   {"la",	HB_TAG('L','A','T',' ')},	/* Latin */
@@ -323,13 +363,19 @@ static const LangTag ot_languages[] = {
   {"lb",	HB_TAG('L','T','Z',' ')},	/* Luxembourgish */
   {"lbe",	HB_TAG('L','A','K',' ')},	/* Lak */
   {"lbj",	HB_TAG('L','D','K',' ')},	/* Ladakhi */
+  {"lez",	HB_TAG('L','E','Z',' ')},	/* Lezgi */
+  {"lg",	HB_TAG('L','U','G',' ')},	/* Luganda */
   {"lif",	HB_TAG('L','M','B',' ')},	/* Limbu */
   {"lld",	HB_TAG('L','A','D',' ')},	/* Ladin */
+  {"lmn",	HB_TAG('L','A','M',' ')},	/* Lambani */
   {"ln",	HB_TAG('L','I','N',' ')},	/* Lingala */
   {"lo",	HB_TAG('L','A','O',' ')},	/* Lao */
   {"lt",	HB_TAG('L','T','H',' ')},	/* Lithuanian */
+  {"lu",	HB_TAG('L','U','B',' ')},	/* Luba-Katanga */
+  {"lua",	HB_TAG('L','U','B',' ')},	/* Luba-Kasai */
   {"luo",	HB_TAG('L','U','O',' ')},	/* Luo (Kenya and Tanzania) */
-  {"luw",	HB_TAG('L','U','O',' ')},	/* Luo (Cameroon) */
+  {"lus",	HB_TAG('M','I','Z',' ')},	/* Mizo */
+  {"luy",	HB_TAG('L','U','H',' ')},	/* Luhya [macrolanguage] */
   {"lv",	HB_TAG('L','V','I',' ')},	/* Latvian */
   {"lzz",	HB_TAG('L','A','Z',' ')},	/* Laz */
   {"mai",	HB_TAG('M','T','H',' ')},	/* Maithili */
@@ -338,6 +384,7 @@ static const LangTag ot_languages[] = {
   {"mdy",	HB_TAG('M','L','E',' ')},	/* Male (Ethiopia) */
   {"men",	HB_TAG('M','D','E',' ')},	/* Mende (Sierra Leone) */
   {"mg",	HB_TAG('M','L','G',' ')},	/* Malagasy */
+  {"mhr",	HB_TAG('L','M','A',' ')},	/* Low Mari */
   {"mi",	HB_TAG('M','R','I',' ')},	/* Maori */
   {"mk",	HB_TAG('M','K','D',' ')},	/* Macedonian */
   {"ml",	HB_TAG('M','L','R',' ')},	/* Malayalam */
@@ -351,14 +398,17 @@ static const LangTag ot_languages[] = {
   {"moh",	HB_TAG('M','O','H',' ')},	/* Mohawk */
   {"mpe",	HB_TAG('M','A','J',' ')},	/* Majang */
   {"mr",	HB_TAG('M','A','R',' ')},	/* Marathi */
+  {"mrj",	HB_TAG('H','M','A',' ')},	/* High Mari */
   {"ms",	HB_TAG('M','L','Y',' ')},	/* Malay */
   {"mt",	HB_TAG('M','T','S',' ')},	/* Maltese */
   {"mwr",	HB_TAG('M','A','W',' ')},	/* Marwari */
   {"my",	HB_TAG('B','R','M',' ')},	/* Burmese */
   {"mym",	HB_TAG('M','E','N',' ')},	/* Me'en */
   {"myv",	HB_TAG('E','R','Z',' ')},	/* Erzya */
+  {"nag",	HB_TAG('N','A','G',' ')},	/* Naga-Assamese */
   {"nb",	HB_TAG('N','O','R',' ')},	/* Norwegian Bokmål */
   {"nco",	HB_TAG('S','I','B',' ')},	/* Sibe */
+  {"nd",	HB_TAG('N','D','B',' ')},	/* [North] Ndebele */
   {"ne",	HB_TAG('N','E','P',' ')},	/* Nepali */
   {"new",	HB_TAG('N','E','W',' ')},	/* Newari */
   {"ng",	HB_TAG('N','D','G',' ')},	/* Ndonga */
@@ -368,33 +418,45 @@ static const LangTag ot_languages[] = {
   {"nl",	HB_TAG('N','L','D',' ')},	/* Dutch */
   {"nn",	HB_TAG('N','Y','N',' ')},	/* Norwegian Nynorsk */
   {"no",	HB_TAG('N','O','R',' ')},	/* Norwegian (deprecated) */
+  {"nod",	HB_TAG('N','T','A',' ')},	/* Northern Tai */
   {"nog",	HB_TAG('N','O','G',' ')},	/* Nogai */
   {"nqo",	HB_TAG('N','K','O',' ')},	/* N'Ko */
+  {"nr",	HB_TAG('N','D','B',' ')},	/* [South] Ndebele */
   {"nsk",	HB_TAG('N','A','S',' ')},	/* Naskapi */
+  {"nso",	HB_TAG('S','O','T',' ')},	/* [Northern] Sotho */
   {"ny",	HB_TAG('C','H','I',' ')},	/* Nyanja */
+  {"nyn",	HB_TAG('N','K','L',' ')},	/* Nkole */
   {"oc",	HB_TAG('O','C','I',' ')},	/* Occitan (post 1500) */
   {"oj",	HB_TAG('O','J','B',' ')},	/* Ojibwa */
+  {"ojs",	HB_TAG('O','C','R',' ')},	/* Oji-Cree */
   {"om",	HB_TAG('O','R','O',' ')},	/* Oromo */
   {"or",	HB_TAG('O','R','I',' ')},	/* Oriya */
   {"os",	HB_TAG('O','S','S',' ')},	/* Ossetian */
   {"pa",	HB_TAG('P','A','N',' ')},	/* Panjabi */
+  {"pce",	HB_TAG('P','L','G',' ')},	/* [Ruching] Palaung */
   {"pi",	HB_TAG('P','A','L',' ')},	/* Pali */
   {"pl",	HB_TAG('P','L','K',' ')},	/* Polish */
+  {"pll",	HB_TAG('P','L','G',' ')},	/* [Shwe] Palaung */
   {"plp",	HB_TAG('P','A','P',' ')},	/* Palpa */
   {"prs",	HB_TAG('D','R','I',' ')},	/* Dari */
   {"ps",	HB_TAG('P','A','S',' ')},	/* Pushto */
   {"pt",	HB_TAG('P','T','G',' ')},	/* Portuguese */
   {"raj",	HB_TAG('R','A','J',' ')},	/* Rajasthani */
+  {"rbb",	HB_TAG('P','L','G',' ')},	/* [Rumai] Palaung */
   {"ria",	HB_TAG('R','I','A',' ')},	/* Riang (India) */
   {"ril",	HB_TAG('R','I','A',' ')},	/* Riang (Myanmar) */
+  {"rki",	HB_TAG('A','R','K',' ')},	/* Arakanese */
+  {"rm",	HB_TAG('R','M','S',' ')},	/* Rhaeto-Romanic */
   {"ro",	HB_TAG('R','O','M',' ')},	/* Romanian */
   {"rom",	HB_TAG('R','O','Y',' ')},	/* Romany */
   {"ru",	HB_TAG('R','U','S',' ')},	/* Russian */
   {"rue",	HB_TAG('R','S','Y',' ')},	/* Rusyn */
+  {"rw",	HB_TAG('R','U','A',' ')},	/* Ruanda */
   {"sa",	HB_TAG('S','A','N',' ')},	/* Sanskrit */
   {"sah",	HB_TAG('Y','A','K',' ')},	/* Yakut */
   {"sat",	HB_TAG('S','A','T',' ')},	/* Santali */
   {"sck",	HB_TAG('S','A','D',' ')},	/* Sadri */
+  {"scs",	HB_TAG('S','L','A',' ')},	/* [North] Slavey */
   {"sd",	HB_TAG('S','N','D',' ')},	/* Sindhi */
   {"se",	HB_TAG('N','S','M',' ')},	/* Northern Sami */
   {"seh",	HB_TAG('S','N','A',' ')},	/* Sena */
@@ -417,6 +479,8 @@ static const LangTag ot_languages[] = {
   {"sq",	HB_TAG('S','Q','I',' ')},	/* Albanian */
   {"sr",	HB_TAG('S','R','B',' ')},	/* Serbian */
   {"srr",	HB_TAG('S','R','R',' ')},	/* Serer */
+  {"ss",	HB_TAG('S','W','Z',' ')},	/* Swazi */
+  {"st",	HB_TAG('S','O','T',' ')},	/* [Southern] Sotho */
   {"suq",	HB_TAG('S','U','R',' ')},	/* Suri */
   {"sv",	HB_TAG('S','V','E',' ')},	/* Swedish */
   {"sva",	HB_TAG('S','V','A',' ')},	/* Svan */
@@ -424,31 +488,34 @@ static const LangTag ot_languages[] = {
   {"swb",	HB_TAG('C','M','R',' ')},	/* Comorian */
   {"syr",	HB_TAG('S','Y','R',' ')},	/* Syriac */
   {"ta",	HB_TAG('T','A','M',' ')},	/* Tamil */
+  {"tab",	HB_TAG('T','A','B',' ')},	/* Tabasaran */
   {"tcy",	HB_TAG('T','U','L',' ')},	/* Tulu */
   {"te",	HB_TAG('T','E','L',' ')},	/* Telugu */
+  {"tem",	HB_TAG('T','M','N',' ')},	/* Temne */
   {"tg",	HB_TAG('T','A','J',' ')},	/* Tajik */
   {"th",	HB_TAG('T','H','A',' ')},	/* Thai */
   {"ti",	HB_TAG('T','G','Y',' ')},	/* Tigrinya */
   {"tig",	HB_TAG('T','G','R',' ')},	/* Tigre */
   {"tk",	HB_TAG('T','K','M',' ')},	/* Turkmen */
   {"tn",	HB_TAG('T','N','A',' ')},	/* Tswana */
-  {"tnz",	HB_TAG('T','N','G',' ')},	/* Tonga (Thailand) */
-  {"to",	HB_TAG('T','N','G',' ')},	/* Tonga (Tonga Islands) */
-  {"tog",	HB_TAG('T','N','G',' ')},	/* Tonga (Nyasa) */
-  {"toi",	HB_TAG('T','N','G',' ')},	/* Tonga (Zambia) */
+  {"to",	HB_TAG('T','G','N',' ')},	/* Tonga (Tonga Islands) */
   {"tr",	HB_TAG('T','R','K',' ')},	/* Turkish */
+  {"tru",	HB_TAG('T','U','A',' ')},	/* Turoyo Aramaic */
   {"ts",	HB_TAG('T','S','G',' ')},	/* Tsonga */
   {"tt",	HB_TAG('T','A','T',' ')},	/* Tatar */
   {"tw",	HB_TAG('T','W','I',' ')},	/* Twi */
   {"ty",	HB_TAG('T','H','T',' ')},	/* Tahitian */
+  {"tyv",	HB_TAG('T','U','V',' ')},	/* Tuvin */
   {"udm",	HB_TAG('U','D','M',' ')},	/* Udmurt */
   {"ug",	HB_TAG('U','Y','G',' ')},	/* Uighur */
   {"uk",	HB_TAG('U','K','R',' ')},	/* Ukrainian */
+  {"umb",	HB_TAG('M','B','N',' ')},	/* [South] Mbundu */
   {"unr",	HB_TAG('M','U','N',' ')},	/* Mundari */
   {"ur",	HB_TAG('U','R','D',' ')},	/* Urdu */
   {"uz",	HB_TAG('U','Z','B',' ')},	/* Uzbek */
   {"ve",	HB_TAG('V','E','N',' ')},	/* Venda */
   {"vi",	HB_TAG('V','I','T',' ')},	/* Vietnamese */
+  {"vmw",	HB_TAG('M','A','K',' ')},	/* Makua */
   {"wbm",	HB_TAG('W','A',' ',' ')},	/* Wa */
   {"wbr",	HB_TAG('W','A','G',' ')},	/* Wagdi */
   {"wo",	HB_TAG('W','L','F',' ')},	/* Wolof */
@@ -462,115 +529,56 @@ static const LangTag ot_languages[] = {
   {"zne",	HB_TAG('Z','N','D',' ')},	/* Zande */
   {"zu",	HB_TAG('Z','U','L',' ')} 	/* Zulu */
 
-  /* I couldn't find the language id for these */
+  /* The corresponding languages IDs for the following IDs are unclear,
+   * overlap, or are architecturally weird. Needs more research. */
 
-/*{"??",	HB_TAG('A','G','W',' ')},*/	/* Agaw */
-/*{"??",	HB_TAG('A','L','S',' ')},*/	/* Alsatian */
-/*{"??",	HB_TAG('A','L','T',' ')},*/	/* Altai */
-/*{"??",	HB_TAG('A','R','K',' ')},*/	/* Arakanese */
-/*{"??",	HB_TAG('A','T','H',' ')},*/	/* Athapaskan */
-/*{"??",	HB_TAG('B','A','G',' ')},*/	/* Baghelkhandi */
-/*{"??",	HB_TAG('B','A','L',' ')},*/	/* Balkar */
-/*{"??",	HB_TAG('B','A','U',' ')},*/	/* Baule */
-/*{"??",	HB_TAG('B','B','R',' ')},*/	/* Berber */
+/*{"ahg/awn/xan?",	HB_TAG('A','G','W',' ')},*/	/* Agaw */
+/*{"gsw?/gsw-FR?",	HB_TAG('A','L','S',' ')},*/	/* Alsatian */
+/*{"krc",	HB_TAG('B','A','L',' ')},*/	/* Balkar */
 /*{"??",	HB_TAG('B','C','R',' ')},*/	/* Bible Cree */
-/*{"??",	HB_TAG('B','E','L',' ')},*/	/* Belarussian */
-/*{"??",	HB_TAG('B','I','L',' ')},*/	/* Bilen */
-/*{"??",	HB_TAG('B','K','F',' ')},*/	/* Blackfoot */
-/*{"??",	HB_TAG('B','L','N',' ')},*/	/* Balante */
-/*{"??",	HB_TAG('B','M','L',' ')},*/	/* Bamileke */
-/*{"??",	HB_TAG('B','R','I',' ')},*/	/* Braj Bhasha */
-/*{"??",	HB_TAG('C','H','G',' ')},*/	/* Chaha Gurage */
-/*{"??",	HB_TAG('C','H','H',' ')},*/	/* Chattisgarhi */
-/*{"??",	HB_TAG('C','H','K',' ')},*/	/* Chukchi */
-/*{"??",	HB_TAG('D','J','R',' ')},*/	/* Djerma */
-/*{"??",	HB_TAG('D','N','G',' ')},*/	/* Dangme */
-/*{"??",	HB_TAG('E','C','R',' ')},*/	/* Eastern Cree */
-/*{"??",	HB_TAG('F','A','N',' ')},*/	/* French Antillean */
-/*{"??",	HB_TAG('F','L','E',' ')},*/	/* Flemish */
-/*{"??",	HB_TAG('F','N','E',' ')},*/	/* Forest Nenets */
-/*{"??",	HB_TAG('F','T','A',' ')},*/	/* Futa */
-/*{"??",	HB_TAG('G','A','R',' ')},*/	/* Garshuni */
-/*{"??",	HB_TAG('G','E','Z',' ')},*/	/* Ge'ez */
-/*{"??",	HB_TAG('H','A','L',' ')},*/	/* Halam */
-/*{"??",	HB_TAG('H','A','R',' ')},*/	/* Harauti */
-/*{"??",	HB_TAG('H','A','W',' ')},*/	/* Hawaiin */
-/*{"??",	HB_TAG('H','B','N',' ')},*/	/* Hammer-Banna */
-/*{"??",	HB_TAG('H','M','A',' ')},*/	/* High Mari */
-/*{"??",	HB_TAG('H','N','D',' ')},*/	/* Hindko */
-/*{"??",	HB_TAG('I','J','O',' ')},*/	/* Ijo */
-/*{"??",	HB_TAG('I','L','O',' ')},*/	/* Ilokano */
-/*{"??",	HB_TAG('I','R','T',' ')},*/	/* Irish Traditional */
-/*{"??",	HB_TAG('J','U','L',' ')},*/	/* Jula */
-/*{"??",	HB_TAG('K','A','R',' ')},*/	/* Karachay */
-/*{"??",	HB_TAG('K','E','B',' ')},*/	/* Kebena */
-/*{"??",	HB_TAG('K','G','E',' ')},*/	/* Khutsuri Georgian */
-/*{"??",	HB_TAG('K','H','A',' ')},*/	/* Khakass */
-/*{"??",	HB_TAG('K','H','K',' ')},*/	/* Khanty-Kazim */
-/*{"??",	HB_TAG('K','H','S',' ')},*/	/* Khanty-Shurishkar */
-/*{"??",	HB_TAG('K','H','V',' ')},*/	/* Khanty-Vakhi */
-/*{"??",	HB_TAG('K','I','S',' ')},*/	/* Kisii */
-/*{"??",	HB_TAG('K','K','N',' ')},*/	/* Kokni */
-/*{"??",	HB_TAG('K','M','S',' ')},*/	/* Komso */
-/*{"??",	HB_TAG('K','O','D',' ')},*/	/* Kodagu */
-/*{"??",	HB_TAG('K','O','H',' ')},*/	/* Korean Old Hangul */
-/*{"??",	HB_TAG('K','O','N',' ')},*/	/* Kikongo */
-/*{"??",	HB_TAG('K','R','K',' ')},*/	/* Karakalpak */
-/*{"??",	HB_TAG('K','R','N',' ')},*/	/* Karen */
-/*{"??",	HB_TAG('K','U','L',' ')},*/	/* Kulvi */
+/*{"sgw?",	HB_TAG('C','H','G',' ')},*/	/* Chaha Gurage */
+/*{"acf/gcf?",	HB_TAG('F','A','N',' ')},*/	/* French Antillean */
+/*{"vls/nl-be",	HB_TAG('F','L','E',' ')},*/	/* Flemish */
+/*{"enf?/yrk?",	HB_TAG('F','N','E',' ')},*/	/* Forest Nenets */
+/*{"fuf?",	HB_TAG('F','T','A',' ')},*/	/* Futa */
+/*{"ar-Syrc?",	HB_TAG('G','A','R',' ')},*/	/* Garshuni */
+/*{"cfm/rnl?",	HB_TAG('H','A','L',' ')},*/	/* Halam */
+/*{"ga-Latg?/Latg?",	HB_TAG('I','R','T',' ')},*/	/* Irish Traditional */
+/*{"krc",	HB_TAG('K','A','R',' ')},*/	/* Karachay */
+/*{"alw?/ktb?",	HB_TAG('K','E','B',' ')},*/	/* Kebena */
+/*{"Geok",	HB_TAG('K','G','E',' ')},*/	/* Khutsuri Georgian */
+/*{"kca",	HB_TAG('K','H','K',' ')},*/	/* Khanty-Kazim */
+/*{"kca",	HB_TAG('K','H','S',' ')},*/	/* Khanty-Shurishkar */
+/*{"kca",	HB_TAG('K','H','V',' ')},*/	/* Khanty-Vakhi */
+/*{"guz?/kqs?/kss?",	HB_TAG('K','I','S',' ')},*/	/* Kisii */
+/*{"kfa/kfi?/kpb?/xua?/xuj?",	HB_TAG('K','O','D',' ')},*/	/* Kodagu */
+/*{"okm?/oko?",	HB_TAG('K','O','H',' ')},*/	/* Korean Old Hangul */
+/*{"kon?/ktu?/...",	HB_TAG('K','O','N',' ')},*/	/* Kikongo */
+/*{"kfx?",	HB_TAG('K','U','L',' ')},*/	/* Kulvi */
 /*{"??",	HB_TAG('L','A','H',' ')},*/	/* Lahuli */
-/*{"??",	HB_TAG('L','A','M',' ')},*/	/* Lambani */
 /*{"??",	HB_TAG('L','C','R',' ')},*/	/* L-Cree */
-/*{"??",	HB_TAG('L','E','Z',' ')},*/	/* Lezgi */
-/*{"??",	HB_TAG('L','M','A',' ')},*/	/* Low Mari */
-/*{"??",	HB_TAG('L','U','B',' ')},*/	/* Luba */
-/*{"??",	HB_TAG('L','U','G',' ')},*/	/* Luganda */
-/*{"??",	HB_TAG('L','U','H',' ')},*/	/* Luhya */
-/*{"??",	HB_TAG('M','A','K',' ')},*/	/* Makua */
 /*{"??",	HB_TAG('M','A','L',' ')},*/	/* Malayalam Traditional */
-/*{"??",	HB_TAG('M','B','N',' ')},*/	/* Mbundu */
-/*{"??",	HB_TAG('M','I','Z',' ')},*/	/* Mizo */
-/*{"??",	HB_TAG('M','L','N',' ')},*/	/* Malinke */
-/*{"??",	HB_TAG('M','N','K',' ')},*/	/* Maninka */
+/*{"mnk?/mlq?/...",	HB_TAG('M','L','N',' ')},*/	/* Malinke */
+/*{"man?/myq?/mku?/msc?/...",	HB_TAG('M','N','K',' ')},*/	/* Maninka */
 /*{"??",	HB_TAG('M','O','R',' ')},*/	/* Moroccan */
-/*{"??",	HB_TAG('N','A','G',' ')},*/	/* Naga-Assamese */
 /*{"??",	HB_TAG('N','C','R',' ')},*/	/* N-Cree */
-/*{"??",	HB_TAG('N','D','B',' ')},*/	/* Ndebele */
-/*{"??",	HB_TAG('N','G','R',' ')},*/	/* Nagari */
 /*{"??",	HB_TAG('N','H','C',' ')},*/	/* Norway House Cree */
-/*{"??",	HB_TAG('N','K','L',' ')},*/	/* Nkole */
-/*{"??",	HB_TAG('N','T','A',' ')},*/	/* Northern Tai */
-/*{"??",	HB_TAG('O','C','R',' ')},*/	/* Oji-Cree */
-/*{"??",	HB_TAG('P','A','A',' ')},*/	/* Palestinian Aramaic */
-/*{"??",	HB_TAG('P','G','R',' ')},*/	/* Polytonic Greek */
-/*{"??",	HB_TAG('P','L','G',' ')},*/	/* Palaung */
-/*{"??",	HB_TAG('Q','I','N',' ')},*/	/* Chin */
-/*{"??",	HB_TAG('R','B','U',' ')},*/	/* Russian Buriat */
+/*{"jpa?/sam?",	HB_TAG('P','A','A',' ')},*/	/* Palestinian Aramaic */
+/*{"polyton",	HB_TAG('P','G','R',' ')},*/	/* Polytonic Greek */
+/*{"??",	HB_TAG('Q','I','N',' ')},*/	/* Asho Chin */
 /*{"??",	HB_TAG('R','C','R',' ')},*/	/* R-Cree */
-/*{"??",	HB_TAG('R','M','S',' ')},*/	/* Rhaeto-Romanic */
-/*{"??",	HB_TAG('R','U','A',' ')},*/	/* Ruanda */
-/*{"??",	HB_TAG('S','A','Y',' ')},*/	/* Sayisi */
-/*{"??",	HB_TAG('S','E','K',' ')},*/	/* Sekota */
-/*{"??",	HB_TAG('S','I','G',' ')},*/	/* Silte Gurage */
-/*{"??",	HB_TAG('S','L','A',' ')},*/	/* Slavey */
-/*{"??",	HB_TAG('S','O','G',' ')},*/	/* Sodo Gurage */
-/*{"??",	HB_TAG('S','O','T',' ')},*/	/* Sotho */
-/*{"??",	HB_TAG('S','W','A',' ')},*/	/* Swadaya Aramaic */
-/*{"??",	HB_TAG('S','W','Z',' ')},*/	/* Swazi */
-/*{"??",	HB_TAG('S','X','T',' ')},*/	/* Sutu */
-/*{"??",	HB_TAG('T','A','B',' ')},*/	/* Tabasaran */
+/*{"chp?",	HB_TAG('S','A','Y',' ')},*/	/* Sayisi */
+/*{"xan?",	HB_TAG('S','E','K',' ')},*/	/* Sekota */
+/*{"stv/wle?/xst?",	HB_TAG('S','I','G',' ')},*/	/* Silte Gurage */
+/*{"ngo?",	HB_TAG('S','X','T',' ')},*/	/* Sutu */
 /*{"??",	HB_TAG('T','C','R',' ')},*/	/* TH-Cree */
-/*{"??",	HB_TAG('T','G','N',' ')},*/	/* Tongan */
-/*{"??",	HB_TAG('T','M','N',' ')},*/	/* Temne */
-/*{"??",	HB_TAG('T','N','E',' ')},*/	/* Tundra Nenets */
+/*{"tnz?/tog?/toi?",	HB_TAG('T','N','G',' ')},*/	/* Tonga */
+/*{"enh?/yrk?",	HB_TAG('T','N','E',' ')},*/	/* Tundra Nenets */
 /*{"??",	HB_TAG('T','O','D',' ')},*/	/* Todo */
-/*{"??",	HB_TAG('T','U','A',' ')},*/	/* Turoyo Aramaic */
-/*{"??",	HB_TAG('T','U','V',' ')},*/	/* Tuvin */
 /*{"??",	HB_TAG('W','C','R',' ')},*/	/* West-Cree */
-/*{"??",	HB_TAG('X','B','D',' ')},*/	/* Tai Lue */
 /*{"??",	HB_TAG('Y','C','R',' ')},*/	/* Y-Cree */
 /*{"??",	HB_TAG('Y','I','C',' ')},*/	/* Yi Classic */
-/*{"??",	HB_TAG('Y','I','M',' ')},*/	/* Yi Modern */
+/*{"ii?/Yiii?",	HB_TAG('Y','I','M',' ')},*/	/* Yi Modern */
 /*{"??",	HB_TAG('Z','H','P',' ')},*/	/* Chinese Phonetic */
 };
 
diff --git a/gfx/harfbuzz/src/hb-private.hh b/gfx/harfbuzz/src/hb-private.hh
index 42c025909ae9..be0d505f7b56 100644
--- a/gfx/harfbuzz/src/hb-private.hh
+++ b/gfx/harfbuzz/src/hb-private.hh
@@ -62,6 +62,12 @@
 #endif
 
 
+/* Void! */
+struct _hb_void_t {};
+typedef const _hb_void_t &hb_void_t;
+#define HB_VOID (* (const _hb_void_t *) NULL)
+
+
 /* Basics */
 
 
@@ -76,7 +82,7 @@ static inline Type MAX (const Type &a, const Type &b) { return a > b ? a : b; }
 
 #undef  ARRAY_LENGTH
 template <typename Type, unsigned int n>
-static inline unsigned int ARRAY_LENGTH (const Type (&a)[n]) { return n; }
+static inline unsigned int ARRAY_LENGTH (const Type (&)[n]) { return n; }
 /* A const version, but does not detect erratically being called on pointers. */
 #define ARRAY_LENGTH_CONST(__array) ((signed int) (sizeof (__array) / sizeof (__array[0])))
 
@@ -503,6 +509,10 @@ static inline uint32_t hb_uint32_swap (const uint32_t v)
 #define hb_be_uint32_get(v)	(uint32_t) ((v[0] << 24) + (v[1] << 16) + (v[2] << 8) + v[3])
 #define hb_be_uint32_eq(a,b)	(a[0] == b[0] && a[1] == b[1] && a[2] == b[2] && a[3] == b[3])
 
+#define hb_be_uint24_put(v,V)	HB_STMT_START { v[0] = (V>>16); v[1] = (V>>8); v[2] (V); } HB_STMT_END
+#define hb_be_uint24_get(v)	(uint32_t) ((v[0] << 16) + (v[1] << 8) + v[2])
+#define hb_be_uint24_eq(a,b)	(a[0] == b[0] && a[1] == b[1] && a[2] == b[2])
+
 
 /* ASCII tag/character handling */
 
@@ -582,7 +592,11 @@ _hb_debug_msg_va (const char *what,
   } else
     fprintf (stderr, "   " VRBAR LBAR);
 
-  if (func) {
+  if (func)
+  {
+    /* Skip "typename" */
+    if (0 == strncmp (func, "typename ", 9))
+      func += 9;
     /* Skip return type */
     const char *space = strchr (func, ' ');
     if (space)
@@ -656,11 +670,40 @@ _hb_debug_msg<0> (const char *what HB_UNUSED,
 #define DEBUG_MSG_FUNC(WHAT, OBJ, ...)				_hb_debug_msg<HB_DEBUG_##WHAT> (#WHAT, (OBJ), HB_FUNC, false, 0, 0, __VA_ARGS__)
 
 
+/*
+ * Printer
+ */
+
+template <typename T>
+struct hb_printer_t {};
+
+template <>
+struct hb_printer_t<bool> {
+  const char *print (bool v) { return v ? "true" : "false"; }
+};
+
+template <>
+struct hb_printer_t<hb_void_t> {
+  const char *print (hb_void_t) { return ""; }
+};
+
+
 /*
  * Trace
  */
 
-template <int max_level>
+template <typename T>
+static inline void _hb_warn_no_return (bool returned)
+{
+  if (unlikely (!returned)) {
+    fprintf (stderr, "OUCH, returned with no call to TRACE_RETURN.  This is a bug, please report.\n");
+  }
+}
+template <>
+inline void _hb_warn_no_return<hb_void_t> (bool returned HB_UNUSED)
+{}
+
+template <int max_level, typename ret_t>
 struct hb_auto_trace_t {
   explicit inline hb_auto_trace_t (unsigned int *plevel_,
 				   const char *what_,
@@ -678,23 +721,23 @@ struct hb_auto_trace_t {
   }
   inline ~hb_auto_trace_t (void)
   {
-    if (unlikely (!returned)) {
-      fprintf (stderr, "OUCH, returned with no call to TRACE_RETURN.  This is a bug, please report.  Level was %d.\n", plevel ? *plevel : -1);
+    _hb_warn_no_return<ret_t> (returned);
+    if (!returned) {
       _hb_debug_msg<max_level> (what, obj, NULL, true, plevel ? *plevel : 1, -1, " ");
-      return;
     }
-
     if (plevel) --*plevel;
   }
 
-  inline bool ret (bool v, unsigned int line = 0)
+  inline ret_t ret (ret_t v, unsigned int line = 0)
   {
     if (unlikely (returned)) {
       fprintf (stderr, "OUCH, double calls to TRACE_RETURN.  This is a bug, please report.\n");
       return v;
     }
 
-    _hb_debug_msg<max_level> (what, obj, NULL, true, plevel ? *plevel : 1, -1, "return %s (line %d)", v ? "true" : "false", line);
+    _hb_debug_msg<max_level> (what, obj, NULL, true, plevel ? *plevel : 1, -1,
+			      "return %s (line %d)",
+			      hb_printer_t<ret_t>().print (v), line);
     if (plevel) --*plevel;
     plevel = NULL;
     returned = true;
@@ -703,12 +746,12 @@ struct hb_auto_trace_t {
 
   private:
   unsigned int *plevel;
-  bool returned;
   const char *what;
   const void *obj;
+  bool returned;
 };
-template <> /* Optimize when tracing is disabled */
-struct hb_auto_trace_t<0> {
+template <typename ret_t> /* Optimize when tracing is disabled */
+struct hb_auto_trace_t<0, ret_t> {
   explicit inline hb_auto_trace_t (unsigned int *plevel_ HB_UNUSED,
 				   const char *what HB_UNUSED,
 				   const void *obj HB_UNUSED,
@@ -716,8 +759,7 @@ struct hb_auto_trace_t<0> {
 				   const char *message HB_UNUSED,
 				   ...) {}
 
-  template <typename T>
-  inline T ret (T v, unsigned int line = 0) { return v; }
+  inline ret_t ret (ret_t v, unsigned int line HB_UNUSED = 0) { return v; }
 };
 
 #define TRACE_RETURN(RET) trace.ret (RET, __LINE__)
diff --git a/gfx/harfbuzz/src/hb-set-private.hh b/gfx/harfbuzz/src/hb-set-private.hh
index c736b69936cb..5e30a7e36165 100644
--- a/gfx/harfbuzz/src/hb-set-private.hh
+++ b/gfx/harfbuzz/src/hb-set-private.hh
@@ -137,6 +137,7 @@ struct hb_set_t
 {
   hb_object_header_t header;
   ASSERT_POD ();
+  bool in_error;
 
   inline void init (void) {
     header.init ();
@@ -145,6 +146,9 @@ struct hb_set_t
   inline void fini (void) {
   }
   inline void clear (void) {
+    if (unlikely (hb_object_is_inert (this)))
+      return;
+    in_error = false;
     memset (elts, 0, sizeof elts);
   }
   inline bool is_empty (void) const {
@@ -155,23 +159,27 @@ struct hb_set_t
   }
   inline void add (hb_codepoint_t g)
   {
+    if (unlikely (in_error)) return;
     if (unlikely (g == SENTINEL)) return;
     if (unlikely (g > MAX_G)) return;
     elt (g) |= mask (g);
   }
   inline void add_range (hb_codepoint_t a, hb_codepoint_t b)
   {
+    if (unlikely (in_error)) return;
     /* TODO Speedup */
     for (unsigned int i = a; i < b + 1; i++)
       add (i);
   }
   inline void del (hb_codepoint_t g)
   {
+    if (unlikely (in_error)) return;
     if (unlikely (g > MAX_G)) return;
     elt (g) &= ~mask (g);
   }
   inline void del_range (hb_codepoint_t a, hb_codepoint_t b)
   {
+    if (unlikely (in_error)) return;
     /* TODO Speedup */
     for (unsigned int i = a; i < b + 1; i++)
       del (i);
@@ -201,29 +209,40 @@ struct hb_set_t
   }
   inline void set (const hb_set_t *other)
   {
+    if (unlikely (in_error)) return;
     for (unsigned int i = 0; i < ELTS; i++)
       elts[i] = other->elts[i];
   }
   inline void union_ (const hb_set_t *other)
   {
+    if (unlikely (in_error)) return;
     for (unsigned int i = 0; i < ELTS; i++)
       elts[i] |= other->elts[i];
   }
   inline void intersect (const hb_set_t *other)
   {
+    if (unlikely (in_error)) return;
     for (unsigned int i = 0; i < ELTS; i++)
       elts[i] &= other->elts[i];
   }
   inline void subtract (const hb_set_t *other)
   {
+    if (unlikely (in_error)) return;
     for (unsigned int i = 0; i < ELTS; i++)
       elts[i] &= ~other->elts[i];
   }
   inline void symmetric_difference (const hb_set_t *other)
   {
+    if (unlikely (in_error)) return;
     for (unsigned int i = 0; i < ELTS; i++)
       elts[i] ^= other->elts[i];
   }
+  inline void invert (void)
+  {
+    if (unlikely (in_error)) return;
+    for (unsigned int i = 0; i < ELTS; i++)
+      elts[i] = ~elts[i];
+  }
   inline bool next (hb_codepoint_t *codepoint) const
   {
     if (unlikely (*codepoint == SENTINEL)) {
diff --git a/gfx/harfbuzz/src/hb-set.cc b/gfx/harfbuzz/src/hb-set.cc
index 37866c40aa17..5f427a5d8e0b 100644
--- a/gfx/harfbuzz/src/hb-set.cc
+++ b/gfx/harfbuzz/src/hb-set.cc
@@ -49,6 +49,7 @@ hb_set_get_empty (void)
 {
   static const hb_set_t _hb_set_nil = {
     HB_OBJECT_HEADER_STATIC,
+    true, /* in_error */
 
     {0} /* elts */
   };
@@ -93,7 +94,7 @@ hb_set_get_user_data (hb_set_t           *set,
 hb_bool_t
 hb_set_allocation_successful (const hb_set_t  *set HB_UNUSED)
 {
-  return true;
+  return !set->in_error;
 }
 
 void
@@ -187,8 +188,14 @@ hb_set_symmetric_difference (hb_set_t       *set,
   set->symmetric_difference (other);
 }
 
+void
+hb_set_invert (hb_set_t *set)
+{
+  set->invert ();
+}
+
 unsigned int
-hb_set_population (const hb_set_t *set)
+hb_set_get_population (const hb_set_t *set)
 {
   return set->get_population ();
 }
diff --git a/gfx/harfbuzz/src/hb-set.h b/gfx/harfbuzz/src/hb-set.h
index 06f358272673..291e24974e65 100644
--- a/gfx/harfbuzz/src/hb-set.h
+++ b/gfx/harfbuzz/src/hb-set.h
@@ -121,8 +121,11 @@ void
 hb_set_symmetric_difference (hb_set_t       *set,
 			     const hb_set_t *other);
 
+void
+hb_set_invert (hb_set_t *set);
+
 unsigned int
-hb_set_population (const hb_set_t *set);
+hb_set_get_population (const hb_set_t *set);
 
 /* Returns -1 if set empty. */
 hb_codepoint_t
diff --git a/gfx/harfbuzz/src/hb-shape-plan-private.hh b/gfx/harfbuzz/src/hb-shape-plan-private.hh
index c5a9927e1ad5..dd014e38d01e 100644
--- a/gfx/harfbuzz/src/hb-shape-plan-private.hh
+++ b/gfx/harfbuzz/src/hb-shape-plan-private.hh
@@ -43,6 +43,7 @@ struct hb_shape_plan_t
   hb_segment_properties_t props;
 
   hb_shape_func_t *shaper_func;
+  const char *shaper_name;
 
   struct hb_shaper_data_t shaper_data;
 };
diff --git a/gfx/harfbuzz/src/hb-shape-plan.cc b/gfx/harfbuzz/src/hb-shape-plan.cc
index d73a8288fb95..22a226f3a6c1 100644
--- a/gfx/harfbuzz/src/hb-shape-plan.cc
+++ b/gfx/harfbuzz/src/hb-shape-plan.cc
@@ -49,6 +49,7 @@ hb_shape_plan_plan (hb_shape_plan_t    *shape_plan,
 	    HB_SHAPER_DATA (shaper, shape_plan) = \
 	      HB_SHAPER_DATA_CREATE_FUNC (shaper, shape_plan) (shape_plan, user_features, num_user_features); \
 	    shape_plan->shaper_func = _hb_##shaper##_shape; \
+	    shape_plan->shaper_name = #shaper; \
 	    return; \
 	  } \
 	} HB_STMT_END
@@ -120,6 +121,7 @@ hb_shape_plan_get_empty (void)
     HB_SEGMENT_PROPERTIES_DEFAULT, /* props */
 
     NULL, /* shaper_func */
+    NULL, /* shaper_name */
 
     {
 #define HB_SHAPER_IMPLEMENT(shaper) HB_SHAPER_DATA_INVALID,
@@ -298,3 +300,9 @@ retry:
 
   return hb_shape_plan_reference (shape_plan);
 }
+
+const char *
+hb_shape_plan_get_shaper (hb_shape_plan_t *shape_plan)
+{
+  return shape_plan->shaper_name;
+}
diff --git a/gfx/harfbuzz/src/hb-shape-plan.h b/gfx/harfbuzz/src/hb-shape-plan.h
index e4ea94b6012d..8f54552f90ba 100644
--- a/gfx/harfbuzz/src/hb-shape-plan.h
+++ b/gfx/harfbuzz/src/hb-shape-plan.h
@@ -80,10 +80,8 @@ hb_shape_plan_execute (hb_shape_plan_t    *shape_plan,
 		       const hb_feature_t *features,
 		       unsigned int        num_features);
 
-#ifdef HB_NOT_IMPLEMENTED
 const char *
-Xhb_shape_plan_get_shaper (hb_shape_plan_t *shape_plan);
-#endif
+hb_shape_plan_get_shaper (hb_shape_plan_t *shape_plan);
 
 
 HB_END_DECLS
diff --git a/gfx/harfbuzz/src/hb-shape.h b/gfx/harfbuzz/src/hb-shape.h
index 90a188d2a9c8..10a35cb517e1 100644
--- a/gfx/harfbuzz/src/hb-shape.h
+++ b/gfx/harfbuzz/src/hb-shape.h
@@ -52,7 +52,7 @@ hb_bool_t
 hb_feature_from_string (const char *str, int len,
 			hb_feature_t *feature);
 
-/* something like 128 bytes is more than enough.
+/* Something like 128 bytes is more than enough.
  * nul-terminates. */
 void
 hb_feature_to_string (hb_feature_t *feature,
diff --git a/gfx/harfbuzz/src/hb-tt-font.cc b/gfx/harfbuzz/src/hb-tt-font.cc
index b7198efdc9f8..c503a404380a 100644
--- a/gfx/harfbuzz/src/hb-tt-font.cc
+++ b/gfx/harfbuzz/src/hb-tt-font.cc
@@ -68,7 +68,7 @@ _hb_tt_font_destroy (hb_tt_font_t *tt)
 static inline const hhea&
 _get_hhea (hb_face_t *face)
 {
-//  return likely (face->tt && face->tt->hhea) ? *face->tt->hhea : Null(hhea);
+  return likely (face->tt && face->tt->hhea) ? *face->tt->hhea : Null(hhea);
 }
 
 
diff --git a/gfx/harfbuzz/src/hb-ucdn.cc b/gfx/harfbuzz/src/hb-ucdn.cc
index 35063043fd6c..61e6ad362298 100644
--- a/gfx/harfbuzz/src/hb-ucdn.cc
+++ b/gfx/harfbuzz/src/hb-ucdn.cc
@@ -129,57 +129,60 @@ static const hb_script_t ucdn_script_translate[] =
 
 static hb_unicode_combining_class_t
 hb_ucdn_combining_class(hb_unicode_funcs_t *ufuncs, hb_codepoint_t unicode,
-        void *user_data)
+			void *user_data HB_UNUSED)
 {
     return (hb_unicode_combining_class_t) ucdn_get_combining_class(unicode);
 }
 
 static unsigned int
 hb_ucdn_eastasian_width(hb_unicode_funcs_t *ufuncs, hb_codepoint_t unicode,
-        void *user_data)
+			void *user_data HB_UNUSED)
 {
     int w = ucdn_get_east_asian_width(unicode);
     return (w == UCDN_EAST_ASIAN_F || w == UCDN_EAST_ASIAN_W) ? 2 : 1;
 }
 
 static hb_unicode_general_category_t
-hb_ucdn_general_category(hb_unicode_funcs_t *ufuncs,
-        hb_codepoint_t unicode, void *user_data)
+hb_ucdn_general_category(hb_unicode_funcs_t *ufuncs, hb_codepoint_t unicode,
+			 void *user_data HB_UNUSED)
 {
     return (hb_unicode_general_category_t)ucdn_get_general_category(unicode);
 }
 
 static hb_codepoint_t
 hb_ucdn_mirroring(hb_unicode_funcs_t *ufuncs, hb_codepoint_t unicode,
-        void *user_data)
+		  void *user_data HB_UNUSED)
 {
     return ucdn_mirror(unicode);
 }
 
 static hb_script_t
 hb_ucdn_script(hb_unicode_funcs_t *ufuncs, hb_codepoint_t unicode,
-        void *user_data)
+	       void *user_data HB_UNUSED)
 {
     return ucdn_script_translate[ucdn_get_script(unicode)];
 }
 
 static hb_bool_t
-hb_ucdn_compose(hb_unicode_funcs_t *ufuncs, hb_codepoint_t a,
-        hb_codepoint_t b, hb_codepoint_t *ab, void *user_data)
+hb_ucdn_compose(hb_unicode_funcs_t *ufuncs,
+		hb_codepoint_t a, hb_codepoint_t b, hb_codepoint_t *ab,
+		void *user_data HB_UNUSED)
 {
     return ucdn_compose(ab, a, b);
 }
 
 static hb_bool_t
-hb_ucdn_decompose(hb_unicode_funcs_t *ufuncs, hb_codepoint_t ab,
-        hb_codepoint_t *a, hb_codepoint_t *b, void *user_data)
+hb_ucdn_decompose(hb_unicode_funcs_t *ufuncs,
+		  hb_codepoint_t ab, hb_codepoint_t *a, hb_codepoint_t *b,
+		  void *user_data HB_UNUSED)
 {
     return ucdn_decompose(ab, a, b);
 }
 
 static unsigned int
-hb_ucdn_decompose_compatibility(hb_unicode_funcs_t *ufuncs, hb_codepoint_t u,
-        hb_codepoint_t *decomposed, void *user_data)
+hb_ucdn_decompose_compatibility(hb_unicode_funcs_t *ufuncs,
+				hb_codepoint_t u, hb_codepoint_t *decomposed,
+				void *user_data HB_UNUSED)
 {
     return ucdn_compat_decompose(u, decomposed);
 }
diff --git a/gfx/harfbuzz/src/hb-uniscribe.cc b/gfx/harfbuzz/src/hb-uniscribe.cc
index 18b88b2234f9..2f01c28778f8 100644
--- a/gfx/harfbuzz/src/hb-uniscribe.cc
+++ b/gfx/harfbuzz/src/hb-uniscribe.cc
@@ -188,6 +188,22 @@ _hb_uniscribe_shaper_font_data_destroy (hb_uniscribe_shaper_font_data_t *data)
   free (data);
 }
 
+LOGFONTW *
+hb_uniscribe_font_get_logfontw (hb_font_t *font)
+{
+  if (unlikely (!hb_uniscribe_shaper_font_data_ensure (font))) return NULL;
+  hb_uniscribe_shaper_font_data_t *font_data =  HB_SHAPER_DATA_GET (font);
+  return &font_data->log_font;
+}
+
+HFONT
+hb_uniscribe_font_get_hfont (hb_font_t *font)
+{
+  if (unlikely (!hb_uniscribe_shaper_font_data_ensure (font))) return NULL;
+  hb_uniscribe_shaper_font_data_t *font_data =  HB_SHAPER_DATA_GET (font);
+  return font_data->hfont;
+}
+
 
 /*
  * shaper shape_plan data
@@ -213,23 +229,6 @@ _hb_uniscribe_shaper_shape_plan_data_destroy (hb_uniscribe_shaper_shape_plan_dat
  * shaper
  */
 
-LOGFONTW *
-hb_uniscribe_font_get_logfontw (hb_font_t *font)
-{
-  if (unlikely (!hb_uniscribe_shaper_font_data_ensure (font))) return NULL;
-    return NULL;
-  hb_uniscribe_shaper_font_data_t *font_data =  HB_SHAPER_DATA_GET (font);
-  return &font_data->log_font;
-}
-
-HFONT
-hb_uniscribe_font_get_hfont (hb_font_t *font)
-{
-  if (unlikely (!hb_uniscribe_shaper_font_data_ensure (font))) return NULL;
-  hb_uniscribe_shaper_font_data_t *font_data =  HB_SHAPER_DATA_GET (font);
-  return font_data->hfont;
-}
-
 
 hb_bool_t
 _hb_uniscribe_shape (hb_shape_plan_t    *shape_plan,
diff --git a/gfx/harfbuzz/src/hb-utf-private.hh b/gfx/harfbuzz/src/hb-utf-private.hh
index ae36ef864e69..b9a6519d28e0 100644
--- a/gfx/harfbuzz/src/hb-utf-private.hh
+++ b/gfx/harfbuzz/src/hb-utf-private.hh
@@ -176,7 +176,7 @@ hb_utf_strlen (const uint16_t *text)
 
 static inline const uint32_t *
 hb_utf_next (const uint32_t *text,
-	     const uint32_t *end,
+	     const uint32_t *end HB_UNUSED,
 	     hb_codepoint_t *unicode)
 {
   *unicode = *text++;
@@ -185,7 +185,7 @@ hb_utf_next (const uint32_t *text,
 
 static inline const uint32_t *
 hb_utf_prev (const uint32_t *text,
-	     const uint32_t *start,
+	     const uint32_t *start HB_UNUSED,
 	     hb_codepoint_t *unicode)
 {
   *unicode = *--text;
diff --git a/gfx/harfbuzz/src/hb-version.h b/gfx/harfbuzz/src/hb-version.h
index f39d946af3fe..df17a1c1eeae 100644
--- a/gfx/harfbuzz/src/hb-version.h
+++ b/gfx/harfbuzz/src/hb-version.h
@@ -38,9 +38,9 @@ HB_BEGIN_DECLS
 
 #define HB_VERSION_MAJOR 0
 #define HB_VERSION_MINOR 9
-#define HB_VERSION_MICRO 6
+#define HB_VERSION_MICRO 10
 
-#define HB_VERSION_STRING "0.9.6"
+#define HB_VERSION_STRING "0.9.10"
 
 #define HB_VERSION_CHECK(major,minor,micro) \
 	((major)*10000+(minor)*100+(micro) >= \
diff --git a/gfx/harfbuzz/src/test-size-params.cc b/gfx/harfbuzz/src/test-size-params.cc
new file mode 100644
index 000000000000..947b5669a145
--- /dev/null
+++ b/gfx/harfbuzz/src/test-size-params.cc
@@ -0,0 +1,93 @@
+/*
+ * Copyright © 2010,2011  Google, Inc.
+ *
+ *  This is part of HarfBuzz, a text shaping library.
+ *
+ * Permission is hereby granted, without written agreement and without
+ * license or royalty fees, to use, copy, modify, and distribute this
+ * software and its documentation for any purpose, provided that the
+ * above copyright notice and the following two paragraphs appear in
+ * all copies of this software.
+ *
+ * IN NO EVENT SHALL THE COPYRIGHT HOLDER BE LIABLE TO ANY PARTY FOR
+ * DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES
+ * ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS DOCUMENTATION, EVEN
+ * IF THE COPYRIGHT HOLDER HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ * THE COPYRIGHT HOLDER SPECIFICALLY DISCLAIMS ANY WARRANTIES, INCLUDING,
+ * BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND
+ * FITNESS FOR A PARTICULAR PURPOSE.  THE SOFTWARE PROVIDED HEREUNDER IS
+ * ON AN "AS IS" BASIS, AND THE COPYRIGHT HOLDER HAS NO OBLIGATION TO
+ * PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
+ *
+ * Google Author(s): Behdad Esfahbod
+ */
+
+#ifdef HAVE_CONFIG_H
+#include "config.h"
+#endif
+
+#include "hb.h"
+#include "hb-ot.h"
+
+#ifdef HAVE_GLIB
+#include <glib.h>
+#endif
+#include <stdlib.h>
+#include <stdio.h>
+
+int
+main (int argc, char **argv)
+{
+  hb_blob_t *blob = NULL;
+
+  if (argc != 2) {
+    fprintf (stderr, "usage: %s font-file\n", argv[0]);
+    exit (1);
+  }
+
+  /* Create the blob */
+  {
+    const char *font_data;
+    unsigned int len;
+    hb_destroy_func_t destroy;
+    void *user_data;
+    hb_memory_mode_t mm;
+
+#ifdef HAVE_GLIB
+    GMappedFile *mf = g_mapped_file_new (argv[1], false, NULL);
+    font_data = g_mapped_file_get_contents (mf);
+    len = g_mapped_file_get_length (mf);
+    destroy = (hb_destroy_func_t) g_mapped_file_unref;
+    user_data = (void *) mf;
+    mm = HB_MEMORY_MODE_READONLY_MAY_MAKE_WRITABLE;
+#else
+    FILE *f = fopen (argv[1], "rb");
+    fseek (f, 0, SEEK_END);
+    len = ftell (f);
+    fseek (f, 0, SEEK_SET);
+    font_data = (const char *) malloc (len);
+    if (!font_data) len = 0;
+    len = fread ((char *) font_data, 1, len, f);
+    destroy = free;
+    user_data = (void *) font_data;
+    fclose (f);
+    mm = HB_MEMORY_MODE_WRITABLE;
+#endif
+
+    blob = hb_blob_create (font_data, len, mm, user_data, destroy);
+  }
+
+  /* Create the face */
+  hb_face_t *face = hb_face_create (blob, 0 /* first face */);
+  hb_blob_destroy (blob);
+  blob = NULL;
+
+  unsigned int p[5];
+  bool ret = hb_ot_layout_get_size_params (face, p, p+1, p+2, p+3, p+4);
+
+  printf ("%g %u %u %g %g\n", p[0]/10., p[1], p[2], p[3]/10., p[4]/10.);
+
+  return !ret;
+}
diff --git a/gfx/layers/Layers.cpp b/gfx/layers/Layers.cpp
index 968b0abc0c65..7640dd9da66c 100644
--- a/gfx/layers/Layers.cpp
+++ b/gfx/layers/Layers.cpp
@@ -768,7 +768,8 @@ Layer::ComputeEffectiveTransformForMaskLayer(const gfx3DMatrix& aTransformToSurf
 void
 ContainerLayer::FillSpecificAttributes(SpecificLayerAttributes& aAttrs)
 {
-  aAttrs = ContainerLayerAttributes(GetFrameMetrics(), mPreXScale, mPreYScale);
+  aAttrs = ContainerLayerAttributes(GetFrameMetrics(), mPreXScale, mPreYScale,
+                                    mInheritedXScale, mInheritedYScale);
 }
 
 bool
diff --git a/gfx/layers/Layers.h b/gfx/layers/Layers.h
index 4f17ab1008da..ac53410bc5cf 100644
--- a/gfx/layers/Layers.h
+++ b/gfx/layers/Layers.h
@@ -1314,11 +1314,23 @@ public:
     if (mPreXScale == aXScale && mPreYScale == aYScale) {
       return;
     }
+
     mPreXScale = aXScale;
     mPreYScale = aYScale;
     Mutated();
   }
 
+  void SetInheritedScale(float aXScale, float aYScale)
+  { 
+    if (mInheritedXScale == aXScale && mInheritedYScale == aYScale) {
+      return;
+    }
+
+    mInheritedXScale = aXScale;
+    mInheritedYScale = aYScale;
+    Mutated();
+  }
+
   virtual void FillSpecificAttributes(SpecificLayerAttributes& aAttrs);
 
   void SortChildrenBy3DZOrder(nsTArray<Layer*>& aArray);
@@ -1332,6 +1344,8 @@ public:
   const FrameMetrics& GetFrameMetrics() { return mFrameMetrics; }
   float GetPreXScale() { return mPreXScale; }
   float GetPreYScale() { return mPreYScale; }
+  float GetInheritedXScale() { return mInheritedXScale; }
+  float GetInheritedYScale() { return mInheritedYScale; }
 
   MOZ_LAYER_DECL_NAME("ContainerLayer", TYPE_CONTAINER)
 
@@ -1384,6 +1398,8 @@ protected:
       mLastChild(nullptr),
       mPreXScale(1.0f),
       mPreYScale(1.0f),
+      mInheritedXScale(1.0f),
+      mInheritedYScale(1.0f),
       mUseIntermediateSurface(false),
       mSupportsComponentAlphaChildren(false),
       mMayHaveReadbackChild(false)
@@ -1409,6 +1425,10 @@ protected:
   FrameMetrics mFrameMetrics;
   float mPreXScale;
   float mPreYScale;
+  // The resolution scale inherited from the parent layer. This will already
+  // be part of mTransform.
+  float mInheritedXScale;
+  float mInheritedYScale;
   bool mUseIntermediateSurface;
   bool mSupportsComponentAlphaChildren;
   bool mMayHaveReadbackChild;
diff --git a/gfx/layers/ipc/AsyncPanZoomController.cpp b/gfx/layers/ipc/AsyncPanZoomController.cpp
index 81e438f42a96..61fdc240de25 100644
--- a/gfx/layers/ipc/AsyncPanZoomController.cpp
+++ b/gfx/layers/ipc/AsyncPanZoomController.cpp
@@ -102,7 +102,8 @@ AsyncPanZoomController::AsyncPanZoomController(GeckoContentController* aGeckoCon
      mDPI(72),
      mWaitingForContentToPaint(false),
      mDisableNextTouchBatch(false),
-     mHandlingTouchQueue(false)
+     mHandlingTouchQueue(false),
+     mDelayPanning(false)
 {
   MOZ_ASSERT(NS_IsMainThread());
   if (aGestures == USE_GESTURE_DETECTOR) {
diff --git a/gfx/layers/ipc/CompositorParent.cpp b/gfx/layers/ipc/CompositorParent.cpp
index f24c9d0e5d5b..6b83c6b83d4b 100644
--- a/gfx/layers/ipc/CompositorParent.cpp
+++ b/gfx/layers/ipc/CompositorParent.cpp
@@ -813,6 +813,11 @@ SampleAnimations(Layer* aLayer, TimeStamp aPoint)
     case eCSSProperty_transform:
     {
       gfx3DMatrix matrix = interpolatedValue.get_ArrayOfTransformFunction()[0].get_TransformMatrix().value();
+      if (ContainerLayer* c = aLayer->AsContainerLayer()) {
+        matrix.ScalePost(c->GetInheritedXScale(),
+                         c->GetInheritedYScale(),
+                         1);
+      }
       shadow->SetShadowTransform(matrix);
       break;
     }
diff --git a/gfx/layers/ipc/GestureEventListener.cpp b/gfx/layers/ipc/GestureEventListener.cpp
index 547a026d6d46..39d2572765fe 100644
--- a/gfx/layers/ipc/GestureEventListener.cpp
+++ b/gfx/layers/ipc/GestureEventListener.cpp
@@ -34,6 +34,7 @@ GestureEventListener::GestureEventListener(AsyncPanZoomController* aAsyncPanZoom
   : mAsyncPanZoomController(aAsyncPanZoomController),
     mState(GESTURE_NONE),
     mSpanChange(0.0f),
+    mTapStartTime(0),
     mLastTapEndTime(0),
     mLastTouchInput(MultiTouchInput::MULTITOUCH_START, 0)
 {
diff --git a/gfx/layers/ipc/PLayers.ipdl b/gfx/layers/ipc/PLayers.ipdl
index 514cd14a0f46..906a539828ed 100644
--- a/gfx/layers/ipc/PLayers.ipdl
+++ b/gfx/layers/ipc/PLayers.ipdl
@@ -190,6 +190,8 @@ struct ContainerLayerAttributes {
   FrameMetrics metrics;
   float preXScale;
   float preYScale;
+  float inheritedXScale;
+  float inheritedYScale;
 };
 struct ColorLayerAttributes     { Color color; };
 struct CanvasLayerAttributes    { GraphicsFilterType filter; };
diff --git a/gfx/layers/ipc/ShadowLayersParent.cpp b/gfx/layers/ipc/ShadowLayersParent.cpp
index b64785b0e987..a2c266aeb2f3 100644
--- a/gfx/layers/ipc/ShadowLayersParent.cpp
+++ b/gfx/layers/ipc/ShadowLayersParent.cpp
@@ -282,6 +282,7 @@ ShadowLayersParent::RecvUpdate(const InfallibleTArray<Edit>& cset,
           specific.get_ContainerLayerAttributes();
         containerLayer->SetFrameMetrics(attrs.metrics());
         containerLayer->SetPreScale(attrs.preXScale(), attrs.preYScale());
+        containerLayer->SetInheritedScale(attrs.inheritedXScale(), attrs.inheritedYScale());
         break;
       }
       case Specific::TColorLayerAttributes:
diff --git a/gfx/thebes/Makefile.in b/gfx/thebes/Makefile.in
index 43c84e4dc2d5..3cb7978e5e9b 100644
--- a/gfx/thebes/Makefile.in
+++ b/gfx/thebes/Makefile.in
@@ -394,8 +394,7 @@ gfxAlphaRecoverySSE2.$(OBJ_SUFFIX): OS_CXXFLAGS += -xarch=sse2 -xO4
 endif
 endif
 
-.PHONY: CONSTANT_TABLES
-CONSTANT_TABLES:
+PremultiplyTables.h: $(srcdir)/genTables.py
 	$(PYTHON) $(srcdir)/genTables.py
 
-gfxUtils.$(OBJ_SUFFIX): CONSTANT_TABLES
+gfxUtils.$(OBJ_SUFFIX): PremultiplyTables.h
diff --git a/gfx/thebes/genTables.py b/gfx/thebes/genTables.py
index de070932501f..d3a924ff4b82 100644
--- a/gfx/thebes/genTables.py
+++ b/gfx/thebes/genTables.py
@@ -3,10 +3,10 @@
 def table_generator(f):
     return ",\n".join([", ".join(["0x%2.2x" % h for h in [f(i) for i in range(r,r+16)]]) for r in range(0, 65536, 16)])
 
-f = open("sPremultiplyTable.h", "w")
-f.write(table_generator(lambda i: ((i / 256) * (i % 256) + 254) / 255) + "\n")
-f.close()
-
-f = open("sUnpremultiplyTable.h", "w")
-f.write(table_generator(lambda i: (i % 256) * 255 / ((i / 256) if (i / 256) > 0 else 255) % 256) + "\n")
-f.close()
+with open("PremultiplyTables.h", "w") as f:
+  f.write("const uint8_t gfxUtils::sPremultiplyTable[256*256] = {\n");
+  f.write(table_generator(lambda i: ((i / 256) * (i % 256) + 254) / 255) + "\n")
+  f.write("};\n");
+  f.write("const uint8_t gfxUtils::sUnpremultiplyTable[256*256] = {\n");
+  f.write(table_generator(lambda i: (i % 256) * 255 / ((i / 256) if (i / 256) > 0 else 255) % 256) + "\n")
+  f.write("};\n");
diff --git a/gfx/thebes/gfxPlatform.cpp b/gfx/thebes/gfxPlatform.cpp
index 490c6e9ac4ad..0a5f0e507909 100644
--- a/gfx/thebes/gfxPlatform.cpp
+++ b/gfx/thebes/gfxPlatform.cpp
@@ -174,7 +174,7 @@ FontPrefsObserver::Observe(nsISupports *aSubject,
     return NS_OK;
 }
 
-class OrientationSyncPrefsObserver : public nsIObserver
+class OrientationSyncPrefsObserver MOZ_FINAL : public nsIObserver
 {
 public:
     NS_DECL_ISUPPORTS
diff --git a/gfx/thebes/gfxUtils.cpp b/gfx/thebes/gfxUtils.cpp
index 526113f745bb..1cd27e7915ef 100644
--- a/gfx/thebes/gfxUtils.cpp
+++ b/gfx/thebes/gfxUtils.cpp
@@ -20,13 +20,7 @@ using namespace mozilla;
 using namespace mozilla::layers;
 using namespace mozilla::gfx;
 
-const uint8_t gfxUtils::sPremultiplyTable[256*256] = {
-#include "sPremultiplyTable.h"
-};
-
-const uint8_t gfxUtils::sUnpremultiplyTable[256*256] = {
-#include "sUnpremultiplyTable.h"
-};
+#include "PremultiplyTables.h"
 
 static const uint8_t PremultiplyValue(uint8_t a, uint8_t v) {
     return gfxUtils::sPremultiplyTable[a*256+v];
diff --git a/hal/gonk/GonkFMRadio.cpp b/hal/gonk/GonkFMRadio.cpp
index d4124df9b81d..45503c69d832 100644
--- a/hal/gonk/GonkFMRadio.cpp
+++ b/hal/gonk/GonkFMRadio.cpp
@@ -189,8 +189,11 @@ runTavaruaRadio(void *)
   buffer.m.userptr = (long unsigned int)buf;
 
   while (sRadioEnabled) {
-    if (ioctl(sRadioFD, VIDIOC_DQBUF, &buffer) < 0)
+    if (ioctl(sRadioFD, VIDIOC_DQBUF, &buffer) < 0) {
+      if (errno == EINTR)
+        continue;
       break;
+    }
 
     for (unsigned int i = 0; i < buffer.bytesused; i++) {
       switch (buf[i]) {
diff --git a/hal/sandbox/SandboxHal.cpp b/hal/sandbox/SandboxHal.cpp
index 535d5b70df68..fb773ed78591 100644
--- a/hal/sandbox/SandboxHal.cpp
+++ b/hal/sandbox/SandboxHal.cpp
@@ -5,7 +5,7 @@
  * You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "Hal.h"
-#include "mozilla/AppProcessPermissions.h"
+#include "mozilla/AppProcessChecker.h"
 #include "mozilla/dom/ContentChild.h"
 #include "mozilla/hal_sandbox/PHalChild.h"
 #include "mozilla/hal_sandbox/PHalParent.h"
diff --git a/image/build/nsImageModule.cpp b/image/build/nsImageModule.cpp
index b6a35cfe099e..f20eaedf9ad7 100644
--- a/image/build/nsImageModule.cpp
+++ b/image/build/nsImageModule.cpp
@@ -5,6 +5,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "mozilla/ModuleUtils.h"
+#include "nsMimeTypes.h"
 
 #include "RasterImage.h"
 
@@ -61,25 +62,25 @@ static const mozilla::Module::ContractIDEntry kImageContracts[] = {
   { "@mozilla.org/image/loader;1", &kNS_IMGLOADER_CID },
   { "@mozilla.org/image/request;1", &kNS_IMGREQUESTPROXY_CID },
   { "@mozilla.org/image/tools;1", &kNS_IMGTOOLS_CID },
-  { "@mozilla.org/image/encoder;2?type=image/vnd.microsoft.icon", &kNS_ICOENCODER_CID },
-  { "@mozilla.org/image/encoder;2?type=image/jpeg", &kNS_JPEGENCODER_CID },
-  { "@mozilla.org/image/encoder;2?type=image/png", &kNS_PNGENCODER_CID },
-  { "@mozilla.org/image/encoder;2?type=image/bmp", &kNS_BMPENCODER_CID },
+  { "@mozilla.org/image/encoder;2?type=" IMAGE_ICO_MS, &kNS_ICOENCODER_CID },
+  { "@mozilla.org/image/encoder;2?type=" IMAGE_JPEG, &kNS_JPEGENCODER_CID },
+  { "@mozilla.org/image/encoder;2?type=" IMAGE_PNG, &kNS_PNGENCODER_CID },
+  { "@mozilla.org/image/encoder;2?type=" IMAGE_BMP, &kNS_BMPENCODER_CID },
   { NULL }
 };
 
 static const mozilla::Module::CategoryEntry kImageCategories[] = {
-  { "Gecko-Content-Viewers", "image/gif", "@mozilla.org/content/document-loader-factory;1" },
-  { "Gecko-Content-Viewers", "image/jpeg", "@mozilla.org/content/document-loader-factory;1" },
-  { "Gecko-Content-Viewers", "image/pjpeg", "@mozilla.org/content/document-loader-factory;1" },
-  { "Gecko-Content-Viewers", "image/jpg", "@mozilla.org/content/document-loader-factory;1" },
-  { "Gecko-Content-Viewers", "image/x-icon", "@mozilla.org/content/document-loader-factory;1" },
-  { "Gecko-Content-Viewers", "image/vnd.microsoft.icon", "@mozilla.org/content/document-loader-factory;1" },
-  { "Gecko-Content-Viewers", "image/bmp", "@mozilla.org/content/document-loader-factory;1" },
-  { "Gecko-Content-Viewers", "image/x-ms-bmp", "@mozilla.org/content/document-loader-factory;1" },
-  { "Gecko-Content-Viewers", "image/icon", "@mozilla.org/content/document-loader-factory;1" },
-  { "Gecko-Content-Viewers", "image/png", "@mozilla.org/content/document-loader-factory;1" },
-  { "Gecko-Content-Viewers", "image/x-png", "@mozilla.org/content/document-loader-factory;1" },
+  { "Gecko-Content-Viewers", IMAGE_GIF, "@mozilla.org/content/document-loader-factory;1" },
+  { "Gecko-Content-Viewers", IMAGE_JPEG, "@mozilla.org/content/document-loader-factory;1" },
+  { "Gecko-Content-Viewers", IMAGE_PJPEG, "@mozilla.org/content/document-loader-factory;1" },
+  { "Gecko-Content-Viewers", IMAGE_JPG, "@mozilla.org/content/document-loader-factory;1" },
+  { "Gecko-Content-Viewers", IMAGE_ICO, "@mozilla.org/content/document-loader-factory;1" },
+  { "Gecko-Content-Viewers", IMAGE_ICO_MS, "@mozilla.org/content/document-loader-factory;1" },
+  { "Gecko-Content-Viewers", IMAGE_BMP, "@mozilla.org/content/document-loader-factory;1" },
+  { "Gecko-Content-Viewers", IMAGE_BMP_MS, "@mozilla.org/content/document-loader-factory;1" },
+  { "Gecko-Content-Viewers", IMAGE_ICON_MS, "@mozilla.org/content/document-loader-factory;1" },
+  { "Gecko-Content-Viewers", IMAGE_PNG, "@mozilla.org/content/document-loader-factory;1" },
+  { "Gecko-Content-Viewers", IMAGE_X_PNG, "@mozilla.org/content/document-loader-factory;1" },
   { "content-sniffing-services", "@mozilla.org/image/loader;1", "@mozilla.org/image/loader;1" },
   { NULL }
 };
diff --git a/image/decoders/icon/android/nsIconChannel.cpp b/image/decoders/icon/android/nsIconChannel.cpp
index e269d379c301..ae307c637763 100644
--- a/image/decoders/icon/android/nsIconChannel.cpp
+++ b/image/decoders/icon/android/nsIconChannel.cpp
@@ -5,6 +5,7 @@
 
 #include <stdlib.h>
 #include "mozilla/dom/ContentChild.h"
+#include "nsMimeTypes.h"
 #include "nsIURL.h"
 #include "nsXULAppAPI.h"
 #include "AndroidBridge.h"
@@ -102,7 +103,7 @@ moz_icon_to_channel(nsIURI *aURI, const nsACString& aFileExt, uint32_t aIconSize
   NS_ENSURE_SUCCESS(rv, rv);
 
   return NS_NewInputStreamChannel(aChannel, aURI, stream,
-                                  NS_LITERAL_CSTRING("image/icon"));
+                                  NS_LITERAL_CSTRING(IMAGE_ICON_MS));
 }
 
 nsresult
diff --git a/image/decoders/icon/gtk/nsIconChannel.cpp b/image/decoders/icon/gtk/nsIconChannel.cpp
index 32e73191f104..ea6db96ec25e 100644
--- a/image/decoders/icon/gtk/nsIconChannel.cpp
+++ b/image/decoders/icon/gtk/nsIconChannel.cpp
@@ -25,6 +25,7 @@ extern "C" {
 
 #include <gtk/gtk.h>
 
+#include "nsMimeTypes.h"
 #include "nsIMIMEService.h"
 
 #include "nsIStringBundle.h"
@@ -125,7 +126,7 @@ moz_gdk_pixbuf_to_channel(GdkPixbuf* aPixbuf, nsIURI *aURI,
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = NS_NewInputStreamChannel(aChannel, aURI, stream,
-                                NS_LITERAL_CSTRING("image/icon"));
+                                NS_LITERAL_CSTRING(IMAGE_ICON_MS));
   return rv;
 }
 
diff --git a/image/decoders/icon/mac/nsIconChannelCocoa.mm b/image/decoders/icon/mac/nsIconChannelCocoa.mm
index d53177b0fb03..f15c33a3940b 100644
--- a/image/decoders/icon/mac/nsIconChannelCocoa.mm
+++ b/image/decoders/icon/mac/nsIconChannelCocoa.mm
@@ -345,7 +345,7 @@ NS_IMETHODIMP nsIconChannel::SetLoadFlags(uint32_t aLoadAttributes)
 
 NS_IMETHODIMP nsIconChannel::GetContentType(nsACString &aContentType) 
 {
-  aContentType.AssignLiteral("image/icon");
+  aContentType.AssignLiteral(IMAGE_ICON_MS);
   return NS_OK;
 }
 
@@ -359,7 +359,7 @@ nsIconChannel::SetContentType(const nsACString &aContentType)
 
 NS_IMETHODIMP nsIconChannel::GetContentCharset(nsACString &aContentCharset) 
 {
-  aContentCharset.AssignLiteral("image/icon");
+  aContentCharset.AssignLiteral(IMAGE_ICON_MS);
   return NS_OK;
 }
 
diff --git a/image/decoders/icon/os2/nsIconChannel.cpp b/image/decoders/icon/os2/nsIconChannel.cpp
index 1906efc949a6..e8823cc13adf 100644
--- a/image/decoders/icon/os2/nsIconChannel.cpp
+++ b/image/decoders/icon/os2/nsIconChannel.cpp
@@ -11,6 +11,7 @@
 #include "nsReadableUtils.h"
 #include "nsMemory.h"
 #include "nsNetUtil.h"
+#include "nsMimeTypes.h"
 #include "nsIFile.h"
 #include "nsIFileURL.h"
 #include "nsDirectoryServiceDefs.h"
@@ -573,7 +574,7 @@ void ConvertMaskBitMap(uint8_t *inBuf, PBITMAPINFO2 pBMInfo,
 
 NS_IMETHODIMP nsIconChannel::GetContentType(nsACString &aContentType) 
 {
-  aContentType.AssignLiteral("image/icon");
+  aContentType.AssignLiteral(IMAGE_ICON_MS);
   return NS_OK;
 }
 
diff --git a/image/decoders/icon/qt/nsIconChannel.cpp b/image/decoders/icon/qt/nsIconChannel.cpp
index d8233bd3fcb9..02d6e0ab1755 100644
--- a/image/decoders/icon/qt/nsIconChannel.cpp
+++ b/image/decoders/icon/qt/nsIconChannel.cpp
@@ -10,6 +10,7 @@
 #include <stdlib.h>
 #include <unistd.h>
 
+#include "nsMimeTypes.h"
 #include "nsIMIMEService.h"
 
 #include "nsIStringBundle.h"
@@ -84,7 +85,7 @@ moz_qicon_to_channel(QImage *image, nsIURI *aURI,
   NS_ENSURE_SUCCESS(rv, rv);
 
   return NS_NewInputStreamChannel(aChannel, aURI, stream,
-                                  NS_LITERAL_CSTRING("image/icon"));
+                                  NS_LITERAL_CSTRING(IMAGE_ICON_MS));
 }
 
 nsresult
diff --git a/image/decoders/icon/win/nsIconChannel.cpp b/image/decoders/icon/win/nsIconChannel.cpp
index f2c2156238bd..63b0b5c11232 100644
--- a/image/decoders/icon/win/nsIconChannel.cpp
+++ b/image/decoders/icon/win/nsIconChannel.cpp
@@ -587,7 +587,7 @@ nsresult nsIconChannel::MakeInputStream(nsIInputStream** _retval, bool nonBlocki
 
 NS_IMETHODIMP nsIconChannel::GetContentType(nsACString &aContentType) 
 {
-  aContentType.AssignLiteral("image/x-icon");
+  aContentType.AssignLiteral(IMAGE_ICO);
   return NS_OK;
 }
 
diff --git a/image/src/Image.cpp b/image/src/Image.cpp
index b3532c336ea3..ddb56692cdef 100644
--- a/image/src/Image.cpp
+++ b/image/src/Image.cpp
@@ -3,6 +3,8 @@
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
+#include "nsMimeTypes.h"
+
 #include "Image.h"
 
 namespace mozilla {
@@ -49,39 +51,39 @@ Image::GetDecoderType(const char *aMimeType)
   eDecoderType rv = eDecoderType_unknown;
 
   // PNG
-  if (!strcmp(aMimeType, "image/png"))
+  if (!strcmp(aMimeType, IMAGE_PNG))
     rv = eDecoderType_png;
-  else if (!strcmp(aMimeType, "image/x-png"))
+  else if (!strcmp(aMimeType, IMAGE_X_PNG))
     rv = eDecoderType_png;
 
   // GIF
-  else if (!strcmp(aMimeType, "image/gif"))
+  else if (!strcmp(aMimeType, IMAGE_GIF))
     rv = eDecoderType_gif;
 
 
   // JPEG
-  else if (!strcmp(aMimeType, "image/jpeg"))
+  else if (!strcmp(aMimeType, IMAGE_JPEG))
     rv = eDecoderType_jpeg;
-  else if (!strcmp(aMimeType, "image/pjpeg"))
+  else if (!strcmp(aMimeType, IMAGE_PJPEG))
     rv = eDecoderType_jpeg;
-  else if (!strcmp(aMimeType, "image/jpg"))
+  else if (!strcmp(aMimeType, IMAGE_JPG))
     rv = eDecoderType_jpeg;
 
   // BMP
-  else if (!strcmp(aMimeType, "image/bmp"))
+  else if (!strcmp(aMimeType, IMAGE_BMP))
     rv = eDecoderType_bmp;
-  else if (!strcmp(aMimeType, "image/x-ms-bmp"))
+  else if (!strcmp(aMimeType, IMAGE_BMP_MS))
     rv = eDecoderType_bmp;
 
 
   // ICO
-  else if (!strcmp(aMimeType, "image/x-icon"))
+  else if (!strcmp(aMimeType, IMAGE_ICO))
     rv = eDecoderType_ico;
-  else if (!strcmp(aMimeType, "image/vnd.microsoft.icon"))
+  else if (!strcmp(aMimeType, IMAGE_ICO_MS))
     rv = eDecoderType_ico;
 
   // Icon
-  else if (!strcmp(aMimeType, "image/icon"))
+  else if (!strcmp(aMimeType, IMAGE_ICON_MS))
     rv = eDecoderType_icon;
 
   return rv;
diff --git a/image/src/ImageFactory.cpp b/image/src/ImageFactory.cpp
index 8e0017adb5a3..f779bcacc166 100644
--- a/image/src/ImageFactory.cpp
+++ b/image/src/ImageFactory.cpp
@@ -9,6 +9,7 @@
 
 #include "nsIHttpChannel.h"
 #include "nsSimpleURI.h"
+#include "nsMimeTypes.h"
 
 #include "RasterImage.h"
 #include "VectorImage.h"
@@ -18,8 +19,6 @@
 namespace mozilla {
 namespace image {
 
-const char* SVG_MIMETYPE = "image/svg+xml";
-
 // Global preferences related to image containers.
 static bool gInitializedPrefCaches = false;
 static bool gDecodeOnDraw = false;
@@ -89,7 +88,7 @@ ImageFactory::CreateImage(nsIRequest* aRequest,
   uint32_t imageFlags = ComputeImageFlags(aURI, aIsMultiPart);
 
   // Select the type of image to create based on MIME type.
-  if (aMimeType.Equals(SVG_MIMETYPE)) {
+  if (aMimeType.EqualsLiteral(IMAGE_SVG_XML)) {
     return CreateVectorImage(aRequest, aStatusTracker, aMimeType,
                              aURI, imageFlags, aInnerWindowId);
   } else {
diff --git a/image/src/ImageFactory.h b/image/src/ImageFactory.h
index e1f6d4560992..442475300a5f 100644
--- a/image/src/ImageFactory.h
+++ b/image/src/ImageFactory.h
@@ -15,8 +15,6 @@
 namespace mozilla {
 namespace image {
 
-extern const char* SVG_MIMETYPE;
-
 class ImageFactory
 {
 public:
diff --git a/image/src/SVGDocumentWrapper.cpp b/image/src/SVGDocumentWrapper.cpp
index 82e3524dcc60..51624f25b189 100644
--- a/image/src/SVGDocumentWrapper.cpp
+++ b/image/src/SVGDocumentWrapper.cpp
@@ -266,6 +266,7 @@ SVGDocumentWrapper::OnStopRequest(nsIRequest* aRequest, nsISupports* ctxt,
       parser->CancelParsingEvents();
       parser->ContinueInterruptedParsing();
     }
+    // XXX flushing is wasteful if embedding frame hasn't had initial reflow
     FlushLayout();
     mListener = nullptr;
 
@@ -342,7 +343,7 @@ SVGDocumentWrapper::SetupViewer(nsIRequest* aRequest,
     do_GetService(NS_CATEGORYMANAGER_CONTRACTID);
   NS_ENSURE_TRUE(catMan, NS_ERROR_NOT_AVAILABLE);
   nsXPIDLCString contractId;
-  nsresult rv = catMan->GetCategoryEntry("Gecko-Content-Viewers", SVG_MIMETYPE,
+  nsresult rv = catMan->GetCategoryEntry("Gecko-Content-Viewers", IMAGE_SVG_XML,
                                          getter_Copies(contractId));
   NS_ENSURE_SUCCESS(rv, rv);
   nsCOMPtr<nsIDocumentLoaderFactory> docLoaderFactory =
@@ -353,7 +354,7 @@ SVGDocumentWrapper::SetupViewer(nsIRequest* aRequest,
   nsCOMPtr<nsIStreamListener> listener;
   rv = docLoaderFactory->CreateInstance("external-resource", chan,
                                         newLoadGroup,
-                                        SVG_MIMETYPE, nullptr, nullptr,
+                                        IMAGE_SVG_XML, nullptr, nullptr,
                                         getter_AddRefs(listener),
                                         getter_AddRefs(viewer));
   NS_ENSURE_SUCCESS(rv, rv);
diff --git a/image/src/SVGDocumentWrapper.h b/image/src/SVGDocumentWrapper.h
index 967390aad573..b58b558f0979 100644
--- a/image/src/SVGDocumentWrapper.h
+++ b/image/src/SVGDocumentWrapper.h
@@ -15,6 +15,7 @@
 #include "nsIObserver.h"
 #include "nsIContentViewer.h"
 #include "nsWeakReference.h"
+#include "nsMimeTypes.h"
 
 class nsIAtom;
 class nsIPresShell;
@@ -24,7 +25,6 @@ class nsIFrame;
 struct nsIntSize;
 class nsSVGSVGElement;
 
-#define SVG_MIMETYPE     "image/svg+xml"
 #define OBSERVER_SVC_CID "@mozilla.org/observer-service;1"
 
 
diff --git a/image/src/VectorImage.cpp b/image/src/VectorImage.cpp
index cb2bfddda237..d804a6fcdd31 100644
--- a/image/src/VectorImage.cpp
+++ b/image/src/VectorImage.cpp
@@ -14,6 +14,7 @@
 #include "nsIObserverService.h"
 #include "nsIPresShell.h"
 #include "nsIStreamListener.h"
+#include "nsMimeTypes.h"
 #include "nsComponentManagerUtils.h"
 #include "nsServiceManagerUtils.h"
 #include "nsSVGUtils.h"  // for nsSVGUtils::ConvertToSurfaceSize
@@ -204,7 +205,7 @@ VectorImage::Init(imgDecoderObserver* aObserver,
   if (aObserver) {
     mObserver = aObserver->asWeakPtr();
   }
-  NS_ABORT_IF_FALSE(!strcmp(aMimeType, SVG_MIMETYPE), "Unexpected mimetype");
+  NS_ABORT_IF_FALSE(!strcmp(aMimeType, IMAGE_SVG_XML), "Unexpected mimetype");
 
   mIsInitialized = true;
 
diff --git a/image/src/imgLoader.cpp b/image/src/imgLoader.cpp
index 9e2ece7c4db8..74132b67387c 100644
--- a/image/src/imgLoader.cpp
+++ b/image/src/imgLoader.cpp
@@ -25,6 +25,7 @@
 #include "nsContentUtils.h"
 #include "nsCrossSiteListenerProxy.h"
 #include "nsNetUtil.h"
+#include "nsMimeTypes.h"
 #include "nsStreamUtils.h"
 #include "nsIHttpChannel.h"
 #include "nsICachingChannel.h"
@@ -957,7 +958,7 @@ void imgLoader::ReadAcceptHeaderPref()
   if (accept)
     mAcceptHeader = accept;
   else
-    mAcceptHeader = "image/png,image/*;q=0.8,*/*;q=0.5";
+    mAcceptHeader = IMAGE_PNG "," IMAGE_WILDCARD ";q=0.8," ANY_WILDCARD ";q=0.5";
 }
 
 /* void clearCache (in boolean chrome); */
@@ -1991,7 +1992,7 @@ nsresult imgLoader::GetMimeTypeFromContent(const char* aContents, uint32_t aLeng
   if (aLength >= 6 && (!nsCRT::strncmp(aContents, "GIF87a", 6) ||
                        !nsCRT::strncmp(aContents, "GIF89a", 6)))
   {
-    aContentType.AssignLiteral("image/gif");
+    aContentType.AssignLiteral(IMAGE_GIF);
   }
 
   /* or a PNG? */
@@ -2004,7 +2005,7 @@ nsresult imgLoader::GetMimeTypeFromContent(const char* aContents, uint32_t aLeng
                    (unsigned char)aContents[6]==0x1A &&
                    (unsigned char)aContents[7]==0x0A))
   { 
-    aContentType.AssignLiteral("image/png");
+    aContentType.AssignLiteral(IMAGE_PNG);
   }
 
   /* maybe a JPEG (JFIF)? */
@@ -2019,7 +2020,7 @@ nsresult imgLoader::GetMimeTypeFromContent(const char* aContents, uint32_t aLeng
      ((unsigned char)aContents[1])==0xD8 &&
      ((unsigned char)aContents[2])==0xFF)
   {
-    aContentType.AssignLiteral("image/jpeg");
+    aContentType.AssignLiteral(IMAGE_JPEG);
   }
 
   /* or how about ART? */
@@ -2031,18 +2032,18 @@ nsresult imgLoader::GetMimeTypeFromContent(const char* aContents, uint32_t aLeng
    ((unsigned char) aContents[1])==0x47 &&
    ((unsigned char) aContents[4])==0x00 )
   {
-    aContentType.AssignLiteral("image/x-jg");
+    aContentType.AssignLiteral(IMAGE_ART);
   }
 
   else if (aLength >= 2 && !nsCRT::strncmp(aContents, "BM", 2)) {
-    aContentType.AssignLiteral("image/bmp");
+    aContentType.AssignLiteral(IMAGE_BMP);
   }
 
   // ICOs always begin with a 2-byte 0 followed by a 2-byte 1.
   // CURs begin with 2-byte 0 followed by 2-byte 2.
   else if (aLength >= 4 && (!memcmp(aContents, "\000\000\001\000", 4) ||
                             !memcmp(aContents, "\000\000\002\000", 4))) {
-    aContentType.AssignLiteral("image/x-icon");
+    aContentType.AssignLiteral(IMAGE_ICO);
   }
 
   else {
diff --git a/image/src/imgRequest.cpp b/image/src/imgRequest.cpp
index dae7c80dbddf..a5f97dccdce8 100644
--- a/image/src/imgRequest.cpp
+++ b/image/src/imgRequest.cpp
@@ -31,6 +31,7 @@
 #include "nsIHttpChannel.h"
 #include "nsIApplicationCache.h"
 #include "nsIApplicationCacheChannel.h"
+#include "nsMimeTypes.h"
 
 #include "nsIComponentManager.h"
 #include "nsIInterfaceRequestorUtils.h"
@@ -726,7 +727,7 @@ imgRequest::OnDataAvailable(nsIRequest *aRequest, nsISupports *ctxt,
     // type and decoder.
     // We always reinitialize for SVGs, because they have no way of
     // reinitializing themselves.
-    if (mContentType != newType || newType.Equals(SVG_MIMETYPE)) {
+    if (mContentType != newType || newType.EqualsLiteral(IMAGE_SVG_XML)) {
       mContentType = newType;
 
       // If we've resniffed our MIME type and it changed, we need to create a
diff --git a/js/public/HashTable.h b/js/public/HashTable.h
index 9e67769fcc2a..861ecf6066c5 100644
--- a/js/public/HashTable.h
+++ b/js/public/HashTable.h
@@ -721,11 +721,9 @@ class HashTable : private AllocPolicy
 
     // A Range whose lifetime delimits a mutating enumeration of a hash table.
     // Since rehashing when elements were removed during enumeration would be
-    // bad, it is postponed until |endEnumeration()| is called. If
-    // |endEnumeration()| is not called before an Enum's constructor, it will
-    // be called automatically. Since |endEnumeration()| touches the hash
-    // table, the user must ensure that the hash table is still alive when this
-    // happens.
+    // bad, it is postponed until the Enum is destructed.  Since the Enum's
+    // destructor touches the hash table, the user must ensure that the hash
+    // table is still alive when the destructor runs.
     class Enum : public Range
     {
         friend class HashTable;
@@ -775,8 +773,9 @@ class HashTable : private AllocPolicy
         ~Enum() {
             if (rekeyed)
                 table.checkOverRemoved();
+
             if (removed)
-                table.checkUnderloaded();
+                table.compactIfUnderloaded();
         }
     };
 
@@ -954,11 +953,15 @@ class HashTable : private AllocPolicy
         return entryCount + removedCount >= ((sMaxAlphaFrac * capacity()) >> 8);
     }
 
+    // Would the table be underloaded if it had the given capacity and entryCount?
+    static bool wouldBeUnderloaded(uint32_t capacity, uint32_t entryCount)
+    {
+        return capacity > sMinSize && entryCount <= ((sMinAlphaFrac * capacity) >> 8);
+    }
+
     bool underloaded()
     {
-        uint32_t tableCapacity = capacity();
-        return tableCapacity > sMinSize &&
-               entryCount <= ((sMinAlphaFrac * tableCapacity) >> 8);
+        return wouldBeUnderloaded(capacity(), entryCount);
     }
 
     static bool match(Entry &e, const Lookup &l)
@@ -1152,6 +1155,23 @@ class HashTable : private AllocPolicy
         }
     }
 
+    // Resize the table down to the largest capacity which doesn't underload the
+    // table.  Since we call checkUnderloaded() on every remove, you only need
+    // to call this after a bulk removal of items done without calling remove().
+    void compactIfUnderloaded()
+    {
+        int32_t resizeLog2 = 0;
+        uint32_t newCapacity = capacity();
+        while (wouldBeUnderloaded(newCapacity, entryCount)) {
+            newCapacity = newCapacity >> 1;
+            resizeLog2--;
+        }
+
+        if (resizeLog2 != 0) {
+            changeTableSize(resizeLog2);
+        }
+    }
+
     // This is identical to changeTableSize(currentSize), but without requiring
     // a second table.  We do this by recycling the collision bits to tell us if
     // the element is already inserted or still waiting to be inserted.  Since
diff --git a/js/public/HeapAPI.h b/js/public/HeapAPI.h
index acf06c0c4e1f..ca1a59608792 100644
--- a/js/public/HeapAPI.h
+++ b/js/public/HeapAPI.h
@@ -157,6 +157,13 @@ ExposeGCThingToActiveJS(void *thing, JSGCTraceKind kind)
         js::IncrementalReferenceBarrier(thing);
 }
 
+static JS_ALWAYS_INLINE void
+ExposeValueToActiveJS(const Value &v)
+{
+    if (v.isMarkable())
+        ExposeGCThingToActiveJS(v.toGCThing(), v.gcKind());
+}
+
 } /* namespace JS */
 
 #endif /* js_heap_api_h___ */
diff --git a/js/public/Utility.h b/js/public/Utility.h
index 0bfb58a6246f..e57bd7f6fc6a 100644
--- a/js/public/Utility.h
+++ b/js/public/Utility.h
@@ -709,6 +709,15 @@ class ReentrancyGuard
     }
 };
 
+template <class T>
+JS_ALWAYS_INLINE static void
+Swap(T &t, T &u)
+{
+    T tmp(Move(t));
+    t = Move(u);
+    u = Move(tmp);
+}
+
 /*
  * Round x up to the nearest power of 2.  This function assumes that the most
  * significant bit of x is not set, which would lead to overflow.
diff --git a/js/src/assembler/assembler/ARMAssembler.h b/js/src/assembler/assembler/ARMAssembler.h
index b10940576a5a..e04b251b7439 100644
--- a/js/src/assembler/assembler/ARMAssembler.h
+++ b/js/src/assembler/assembler/ARMAssembler.h
@@ -532,17 +532,21 @@ namespace JSC {
         // pc relative loads (useful for loading from pools).
         void ldr_imm(int rd, ARMWord imm, Condition cc = AL)
         {
+#if defined(JS_METHODJIT_SPEW)
             char mnemonic[16];
             snprintf(mnemonic, 16, "ldr%s", nameCC(cc));
             spew("%-15s %s, =0x%x @ (%d) (reusable pool entry)", mnemonic, nameGpReg(rd), imm, static_cast<int32_t>(imm));
+#endif
             m_buffer.putIntWithConstantInt(static_cast<ARMWord>(cc) | DTR | DT_LOAD | DT_UP | RN(ARMRegisters::pc) | RD(rd), imm, true);
         }
 
         void ldr_un_imm(int rd, ARMWord imm, Condition cc = AL)
         {
+#if defined(JS_METHODJIT_SPEW)
             char mnemonic[16];
             snprintf(mnemonic, 16, "ldr%s", nameCC(cc));
             spew("%-15s %s, =0x%x @ (%d)", mnemonic, nameGpReg(rd), imm, static_cast<int32_t>(imm));
+#endif
             m_buffer.putIntWithConstantInt(static_cast<ARMWord>(cc) | DTR | DT_LOAD | DT_UP | RN(ARMRegisters::pc) | RD(rd), imm);
         }
 
@@ -1335,6 +1339,7 @@ namespace JSC {
 
         void spewInsWithOp2(char const * ins, Condition cc, int rd, int rn, ARMWord op2)
         {
+#if defined(JS_METHODJIT_SPEW)
             char    mnemonic[16];
             snprintf(mnemonic, 16, "%s%s", ins, nameCC(cc));
 
@@ -1342,10 +1347,12 @@ namespace JSC {
             fmtOp2(op2_fmt, op2);
 
             spew("%-15s %s, %s, %s", mnemonic, nameGpReg(rd), nameGpReg(rn), op2_fmt);
+#endif
         }
 
         void spewInsWithOp2(char const * ins, Condition cc, int r, ARMWord op2)
         {
+#if defined(JS_METHODJIT_SPEW)
             char    mnemonic[16];
             snprintf(mnemonic, 16, "%s%s", ins, nameCC(cc));
 
@@ -1353,6 +1360,7 @@ namespace JSC {
             fmtOp2(op2_fmt, op2);
 
             spew("%-15s %s, %s", mnemonic, nameGpReg(r), op2_fmt);
+#endif
         }
 
         ARMWord RM(int reg)
diff --git a/js/src/assembler/jit/ExecutableAllocator.h b/js/src/assembler/jit/ExecutableAllocator.h
index 2fe679b9a311..20015a255b8a 100644
--- a/js/src/assembler/jit/ExecutableAllocator.h
+++ b/js/src/assembler/jit/ExecutableAllocator.h
@@ -267,7 +267,7 @@ private:
     static size_t pageSize;
     static size_t largeAllocSize;
 #if WTF_OS_WINDOWS
-    static int64_t rngSeed;
+    static uint64_t rngSeed;
 #endif
 
     static const size_t OVERSIZE_ALLOCATION = size_t(-1);
diff --git a/js/src/assembler/jit/ExecutableAllocatorWin.cpp b/js/src/assembler/jit/ExecutableAllocatorWin.cpp
index 910f44720b8f..6fd93545ab8c 100644
--- a/js/src/assembler/jit/ExecutableAllocatorWin.cpp
+++ b/js/src/assembler/jit/ExecutableAllocatorWin.cpp
@@ -30,12 +30,12 @@
 #include "jswin.h"
 #include "prmjtime.h"
 
-extern void random_setSeed(int64_t *, int64_t);
-extern uint64_t random_next(int64_t *, int);
+extern void random_setSeed(uint64_t *, uint64_t);
+extern uint64_t random_next(uint64_t *, int);
 
 namespace JSC {
 
-int64_t ExecutableAllocator::rngSeed;
+uint64_t ExecutableAllocator::rngSeed;
 
 void ExecutableAllocator::initSeed()
 {
diff --git a/js/src/builtin/Object.cpp b/js/src/builtin/Object.cpp
index ecd9f4769cc6..4868465b3b77 100644
--- a/js/src/builtin/Object.cpp
+++ b/js/src/builtin/Object.cpp
@@ -137,12 +137,11 @@ obj_toSource(JSContext *cx, unsigned argc, Value *vp)
     if (!buf.append('{'))
         return false;
 
-    Value val[2];
-    PodArrayZero(val);
-    AutoArrayRooter tvr2(cx, ArrayLength(val), val);
+    RootedValue v0(cx), v1(cx);
+    MutableHandleValue val[2] = {&v0, &v1};
 
-    JSString *gsop[2];
-    SkipRoot skipGsop(cx, &gsop, 2);
+    RootedString str0(cx), str1(cx);
+    MutableHandleString gsop[2] = {&str0, &str1};
 
     AutoIdVector idv(cx);
     if (!GetPropertyNames(cx, obj, JSITER_OWNONLY, &idv))
@@ -164,22 +163,21 @@ obj_toSource(JSContext *cx, unsigned argc, Value *vp)
                 unsigned attrs = shape->attributes();
                 if (attrs & JSPROP_GETTER) {
                     doGet = false;
-                    val[valcnt] = shape->getterValue();
-                    gsop[valcnt] = cx->names().get;
+                    val[valcnt].set(shape->getterValue());
+                    gsop[valcnt].set(cx->names().get);
                     valcnt++;
                 }
                 if (attrs & JSPROP_SETTER) {
                     doGet = false;
-                    val[valcnt] = shape->setterValue();
-                    gsop[valcnt] = cx->names().set;
+                    val[valcnt].set(shape->setterValue());
+                    gsop[valcnt].set(cx->names().set);
                     valcnt++;
                 }
             }
             if (doGet) {
                 valcnt = 1;
-                gsop[0] = NULL;
-                MutableHandleValue vp = MutableHandleValue::fromMarkedLocation(&val[0]);
-                if (!JSObject::getGeneric(cx, obj, obj, id, vp))
+                gsop[0].set(NULL);
+                if (!JSObject::getGeneric(cx, obj, obj, id, val[0]))
                     return false;
             }
         }
@@ -252,7 +250,7 @@ obj_toSource(JSContext *cx, unsigned argc, Value *vp)
                         vchars++;
                     vlength = end - vchars - parenChomp;
                 } else {
-                    gsop[j] = NULL;
+                    gsop[j].set(NULL);
                     vchars = start;
                 }
             }
diff --git a/js/src/builtin/RegExp.cpp b/js/src/builtin/RegExp.cpp
index 7155ba2ccb59..aac67fe8a320 100644
--- a/js/src/builtin/RegExp.cpp
+++ b/js/src/builtin/RegExp.cpp
@@ -143,7 +143,7 @@ js::ExecuteRegExpLegacy(JSContext *cx, RegExpStatics *res, RegExpObject &reobj,
                         Handle<JSStableString*> input, StableCharPtr chars, size_t length,
                         size_t *lastIndex, JSBool test, jsval *rval)
 {
-    RegExpGuard shared;
+    RegExpGuard shared(cx);
     if (!reobj.getShared(cx, &shared))
         return false;
 
@@ -252,7 +252,7 @@ CompileRegExpObject(JSContext *cx, RegExpObjectBuilder &builder, CallArgs args)
          */
         RegExpFlag flags;
         {
-            RegExpGuard g;
+            RegExpGuard g(cx);
             if (!RegExpToShared(cx, *sourceObj, &g))
                 return false;
 
@@ -533,17 +533,6 @@ js_InitRegExpClass(JSContext *cx, HandleObject obj)
     if (!JS_DefineProperties(cx, ctor, regexp_static_props))
         return NULL;
 
-    /* Capture normal data properties pregenerated for RegExp objects. */
-    TypeObject *type = proto->getNewType(cx);
-    if (!type)
-        return NULL;
-    AddTypeProperty(cx, type, "source", Type::StringType());
-    AddTypeProperty(cx, type, "global", Type::BooleanType());
-    AddTypeProperty(cx, type, "ignoreCase", Type::BooleanType());
-    AddTypeProperty(cx, type, "multiline", Type::BooleanType());
-    AddTypeProperty(cx, type, "sticky", Type::BooleanType());
-    AddTypeProperty(cx, type, "lastIndex", Type::Int32Type());
-
     if (!DefineConstructorAndPrototype(cx, global, JSProto_RegExp, ctor, proto))
         return NULL;
 
@@ -556,7 +545,7 @@ js::ExecuteRegExp(JSContext *cx, HandleObject regexp, HandleString string, Match
     /* Step 1 (b) was performed by CallNonGenericMethod. */
     Rooted<RegExpObject*> reobj(cx, &regexp->asRegExp());
 
-    RegExpGuard re;
+    RegExpGuard re(cx);
     if (!reobj->getShared(cx, &re))
         return RegExpRunStatus_Error;
 
diff --git a/js/src/configure.in b/js/src/configure.in
index 791ad31f18e3..1e34bf1240cb 100644
--- a/js/src/configure.in
+++ b/js/src/configure.in
@@ -4097,6 +4097,29 @@ else
   fi
 fi
 
+dnl ========================================================
+dnl = Disable -fstrict-aliasing on Linux/Android with GCC 4.4 and earlier.
+dnl = See bug 821502.
+dnl ========================================================
+case "$target" in
+*-android*|*-linuxandroid*|*-*linux*)
+    if test "$GNU_CC"; then
+        changequote(,)
+        GCC_VERSION_FULL=`echo "$CXX_VERSION" | $PERL -pe 's/^.*gcc version ([^ ]*).*/$1/'`
+        GCC_VERSION=`echo "$GCC_VERSION_FULL" | $PERL -pe '(split(/\./))[0]>=4&&s/(^\d*\.\d*).*/$1/;'`
+        changequote([,])
+
+        GCC_MAJOR_VERSION=`echo ${GCC_VERSION} | $AWK -F\. '{ print $1 }'`
+        GCC_MINOR_VERSION=`echo ${GCC_VERSION} | $AWK -F\. '{ print $2 }'`
+
+        dnl GCC 3.x isn't supported, so we don't need to check for that.
+        if test "$GCC_MAJOR_VERSION" -eq "4" -a "$GCC_MINOR_VERSION" -lt "5" ; then
+            CFLAGS="$CFLAGS -fno-strict-aliasing"
+            CXXFLAGS="$CXXFLAGS -fno-strict-aliasing"
+        fi
+    fi
+esac
+
 dnl ========================================================
 dnl = Link js shell to system readline
 dnl ========================================================
diff --git a/js/src/ctypes/CTypes.cpp b/js/src/ctypes/CTypes.cpp
index 95560ae20f79..48e57da2cf0f 100644
--- a/js/src/ctypes/CTypes.cpp
+++ b/js/src/ctypes/CTypes.cpp
@@ -2138,7 +2138,7 @@ bool CanConvertTypedArrayItemTo(JSObject *baseType, JSObject *valObj, JSContext
     return true;
   }
   TypeCode elementTypeCode;
-  switch (JS_GetTypedArrayType(valObj)) {
+  switch (JS_GetArrayBufferViewType(valObj)) {
   case TypedArray::TYPE_INT8:
     elementTypeCode = TYPE_int8_t;
     break;
@@ -5790,9 +5790,7 @@ FunctionType::Call(JSContext* cx,
   }
 
   // Let the runtime callback know that we are about to call into C.
-  js::CTypesActivityCallback activityCallback = cx->runtime->ctypesActivityCallback;
-  if (activityCallback)
-    activityCallback(cx, js::CTYPES_CALL_BEGIN);
+  js::AutoCTypesActivityCallback autoCallback(cx, js::CTYPES_CALL_BEGIN, js::CTYPES_CALL_END);
 
   uintptr_t fn = *reinterpret_cast<uintptr_t*>(CData::GetData(obj));
 
@@ -5821,8 +5819,8 @@ FunctionType::Call(JSContext* cx,
 
   errno = savedErrno;
 
-  if (activityCallback)
-    activityCallback(cx, js::CTYPES_CALL_END);
+  // We're no longer calling into C.
+  autoCallback.DoEndCallback();
 
   // Store the error value for later consultation with |ctypes.getStatus|
   JSObject *objCTypes = CType::GetGlobalCTypes(cx, typeObj);
@@ -6105,6 +6103,12 @@ CClosure::ClosureStub(ffi_cif* cif, void* result, void** args, void* userData)
   // Retrieve the essentials from our closure object.
   ClosureInfo* cinfo = static_cast<ClosureInfo*>(userData);
   JSContext* cx = cinfo->cx;
+
+  // Let the runtime callback know that we are about to call into JS again. The end callback will
+  // fire automatically when we exit this function.
+  js::AutoCTypesActivityCallback autoCallback(cx, js::CTYPES_CALLBACK_BEGIN,
+                                              js::CTYPES_CALLBACK_END);
+
   RootedObject typeObj(cx, cinfo->typeObj);
   RootedObject thisObj(cx, cinfo->thisObj);
   RootedObject jsfnObj(cx, cinfo->jsfnObj);
diff --git a/js/src/frontend/TokenStream.cpp b/js/src/frontend/TokenStream.cpp
index 20188f976326..900b55d1282e 100644
--- a/js/src/frontend/TokenStream.cpp
+++ b/js/src/frontend/TokenStream.cpp
@@ -119,15 +119,12 @@ frontend::IsIdentifier(JSLinearString *str)
 TokenStream::TokenStream(JSContext *cx, const CompileOptions &options,
                          StableCharPtr base, size_t length, StrictModeGetter *smg)
   : tokens(),
-    tokensRoot(cx, &tokens),
     cursor(),
     lookahead(),
     lineno(options.lineno),
     flags(),
     linebase(base.get()),
     prevLinebase(NULL),
-    linebaseRoot(cx, &linebase),
-    prevLinebaseRoot(cx, &prevLinebase),
     userbuf(base.get(), length),
     filename(options.filename),
     sourceMap(NULL),
@@ -139,7 +136,8 @@ TokenStream::TokenStream(JSContext *cx, const CompileOptions &options,
     cx(cx),
     originPrincipals(JSScript::normalizeOriginPrincipals(options.principals,
                                                          options.originPrincipals)),
-    strictModeGetter(smg)
+    strictModeGetter(smg),
+    tokenSkip(cx, &tokens)
 {
     if (originPrincipals)
         JS_HoldPrincipals(originPrincipals);
@@ -1442,8 +1440,6 @@ TokenStream::getTokenInternal()
     const jschar *identStart;
     bool hadUnicodeEscape;
 
-    SkipRoot skipNum(cx, &numStart), skipIdent(cx, &identStart);
-
 #if JS_HAS_XML_SUPPORT
     /*
      * Look for XML text and tags.
diff --git a/js/src/frontend/TokenStream.h b/js/src/frontend/TokenStream.h
index eccf0eba2be9..336364738b86 100644
--- a/js/src/frontend/TokenStream.h
+++ b/js/src/frontend/TokenStream.h
@@ -852,15 +852,12 @@ class TokenStream
     void updateFlagsForEOL();
 
     Token               tokens[ntokens];/* circular token buffer */
-    js::SkipRoot        tokensRoot;     /* prevent overwriting of token buffer */
     unsigned            cursor;         /* index of last parsed token */
     unsigned            lookahead;      /* count of lookahead tokens */
     unsigned            lineno;         /* current line number */
     unsigned            flags;          /* flags -- see above */
     const jschar        *linebase;      /* start of current line;  points into userbuf */
     const jschar        *prevLinebase;  /* start of previous line;  NULL if on the first line */
-    js::SkipRoot        linebaseRoot;
-    js::SkipRoot        prevLinebaseRoot;
     TokenBuf            userbuf;        /* user input buffer */
     const char          *filename;      /* input filename or null */
     jschar              *sourceMap;     /* source map's filename or null */
@@ -876,6 +873,13 @@ class TokenStream
     JSPrincipals        *const originPrincipals;
     StrictModeGetter    *strictModeGetter; /* used to test for strict mode */
     Position            lastFunctionKeyword; /* used as a starting point for reparsing strict functions */
+
+    /*
+     * The tokens array stores pointers to JSAtoms. These are rooted by the
+     * atoms table using AutoKeepAtoms in the Parser. This SkipRoot tells the
+     * exact rooting analysis to ignore the atoms in the tokens array.
+     */
+    SkipRoot            tokenSkip;
 };
 
 struct KeywordInfo {
diff --git a/js/src/gc/Marking.cpp b/js/src/gc/Marking.cpp
index 94e3e4c51146..c45044da57d6 100644
--- a/js/src/gc/Marking.cpp
+++ b/js/src/gc/Marking.cpp
@@ -1569,6 +1569,21 @@ struct UnmarkGrayTracer : public JSTracer
  * black in step 2 above. This must be done on everything reachable from the
  * object being returned. The following code takes care of the recursive
  * re-coloring.
+ *
+ * There is an additional complication for certain kinds of edges that are not
+ * contained explicitly in the source object itself, such as from a weakmap key
+ * to its value, and from an object being watched by a watchpoint to the
+ * watchpoint's closure. These "implicit edges" are represented in some other
+ * container object, such as the weakmap or the watchpoint itself. In these
+ * cases, calling unmark gray on an object won't find all of its children.
+ *
+ * Handling these implicit edges has two parts:
+ * - A special pass enumerating all of the containers that know about the
+ *   implicit edges to fix any black-gray edges that have been created. This
+ *   is implemented in nsXPConnect::FixWeakMappingGrayBits.
+ * - To prevent any incorrectly gray objects from escaping to live JS outside
+ *   of the containers, we must add unmark-graying read barriers to these
+ *   containers.
  */
 static void
 UnmarkGrayChildren(JSTracer *trc, void **thingp, JSGCTraceKind kind)
diff --git a/js/src/gc/Root.h b/js/src/gc/Root.h
index 00729c7b2c48..5ca7098de115 100644
--- a/js/src/gc/Root.h
+++ b/js/src/gc/Root.h
@@ -272,25 +272,13 @@ template <typename T>
 class MutableHandle : public js::MutableHandleBase<T>
 {
   public:
-    template <typename S>
-    MutableHandle(MutableHandle<S> handle,
-                  typename mozilla::EnableIf<mozilla::IsConvertible<S, T>::value, int>::Type dummy = 0)
-    {
-        this->ptr = reinterpret_cast<const T *>(handle.address());
-    }
-
-    template <typename S>
-    inline MutableHandle(js::Rooted<S> *root,
-                         typename mozilla::EnableIf<mozilla::IsConvertible<S, T>::value, int>::Type dummy = 0);
+    inline MutableHandle(js::Rooted<T> *root);
 
     void set(T v) {
         JS_ASSERT(!js::RootMethods<T>::poisoned(v));
         *ptr = v;
     }
 
-    template <typename S>
-    inline void set(const js::Unrooted<S> &v);
-
     /*
      * This may be called only if the location of the T is guaranteed
      * to be marked (for some reason other than being a Rooted),
@@ -859,21 +847,13 @@ Handle<T>::Handle(MutableHandle<S> &root,
     ptr = reinterpret_cast<const T *>(root.address());
 }
 
-template <typename T> template <typename S>
+template <typename T>
 inline
-MutableHandle<T>::MutableHandle(js::Rooted<S> *root,
-                                typename mozilla::EnableIf<mozilla::IsConvertible<S, T>::value, int>::Type dummy)
+MutableHandle<T>::MutableHandle(js::Rooted<T> *root)
 {
     ptr = root->address();
 }
 
-template <typename T> template <typename S>
-inline void MutableHandle<T>::set(const js::Unrooted<S> &v)
-{
-    JS_ASSERT(!js::RootMethods<T>::poisoned(v));
-    *ptr = static_cast<S>(v);
-}
-
 /*
  * The scoped guard object AutoAssertNoGC forces the GC to assert if a GC is
  * attempted while the guard object is live.  If you have a GC-unsafe operation
diff --git a/js/src/ion/BacktrackingAllocator.cpp b/js/src/ion/BacktrackingAllocator.cpp
index 6fa5c2279b56..491b49a3bd2f 100644
--- a/js/src/ion/BacktrackingAllocator.cpp
+++ b/js/src/ion/BacktrackingAllocator.cpp
@@ -316,7 +316,7 @@ BacktrackingAllocator::tryGroupReusedRegister(uint32_t def, uint32_t use)
     if (!newIntervals.append(preInterval) || !newIntervals.append(postInterval))
         return false;
 
-    if (!split(interval, newIntervals))
+    if (!distributeUses(interval, newIntervals) || !split(interval, newIntervals))
         return false;
 
     JS_ASSERT(usedReg.numIntervals() == 2);
@@ -440,6 +440,7 @@ BacktrackingAllocator::processInterval(LiveInterval *interval)
 
     bool canAllocate = setIntervalRequirement(interval);
 
+    bool fixed;
     LiveInterval *conflict;
     for (size_t attempt = 0;; attempt++) {
         if (canAllocate) {
@@ -452,6 +453,7 @@ BacktrackingAllocator::processInterval(LiveInterval *interval)
                 return true;
             }
 
+            fixed = false;
             conflict = NULL;
 
             // If we want, but do not require an interval to be in a specific
@@ -462,7 +464,7 @@ BacktrackingAllocator::processInterval(LiveInterval *interval)
             if (interval->hint()->kind() == Requirement::FIXED) {
                 AnyRegister reg = interval->hint()->allocation().toRegister();
                 bool success;
-                if (!tryAllocateRegister(registers[reg.code()], interval, &success, &conflict))
+                if (!tryAllocateRegister(registers[reg.code()], interval, &success, &fixed, &conflict))
                     return false;
                 if (success)
                     return true;
@@ -479,7 +481,7 @@ BacktrackingAllocator::processInterval(LiveInterval *interval)
                 // allocated to.
                 for (size_t i = 0; i < AnyRegister::Total; i++) {
                     bool success;
-                    if (!tryAllocateRegister(registers[i], interval, &success, &conflict))
+                    if (!tryAllocateRegister(registers[i], interval, &success, &fixed, &conflict))
                         return false;
                     if (success)
                         return true;
@@ -491,6 +493,7 @@ BacktrackingAllocator::processInterval(LiveInterval *interval)
 
         if (attempt < MAX_ATTEMPTS &&
             canAllocate &&
+            !fixed &&
             conflict &&
             computeSpillWeight(conflict) < computeSpillWeight(interval))
         {
@@ -505,6 +508,8 @@ BacktrackingAllocator::processInterval(LiveInterval *interval)
         // be constructed so that any minimal interval is allocatable.
         JS_ASSERT(!minimalInterval(interval));
 
+        if (canAllocate && fixed)
+            return splitAcrossCalls(interval);
         return chooseIntervalSplit(interval);
     }
 }
@@ -517,13 +522,15 @@ BacktrackingAllocator::processGroup(VirtualRegisterGroup *group)
                 group->registers[0], computePriority(group), computeSpillWeight(group));
     }
 
+    bool fixed;
     LiveInterval *conflict;
     for (size_t attempt = 0;; attempt++) {
         // Search for any available register which the group can be allocated to.
+        fixed = false;
         conflict = NULL;
         for (size_t i = 0; i < AnyRegister::Total; i++) {
             bool success;
-            if (!tryAllocateGroupRegister(registers[i], group, &success, &conflict))
+            if (!tryAllocateGroupRegister(registers[i], group, &success, &fixed, &conflict))
                 return false;
             if (success) {
                 conflict = NULL;
@@ -532,7 +539,9 @@ BacktrackingAllocator::processGroup(VirtualRegisterGroup *group)
         }
 
         if (attempt < MAX_ATTEMPTS &&
+            !fixed &&
             conflict &&
+            conflict->hasVreg() &&
             computeSpillWeight(conflict) < computeSpillWeight(group))
         {
             if (!evictInterval(conflict))
@@ -610,7 +619,7 @@ BacktrackingAllocator::setIntervalRequirement(LiveInterval *interval)
 
 bool
 BacktrackingAllocator::tryAllocateGroupRegister(PhysicalRegister &r, VirtualRegisterGroup *group,
-                                                bool *psuccess, LiveInterval **pconflicting)
+                                                bool *psuccess, bool *pfixed, LiveInterval **pconflicting)
 {
     *psuccess = false;
 
@@ -646,6 +655,8 @@ BacktrackingAllocator::tryAllocateGroupRegister(PhysicalRegister &r, VirtualRegi
         JS_ASSERT(conflicting);
         if (!*pconflicting || computeSpillWeight(conflicting) < computeSpillWeight(*pconflicting))
             *pconflicting = conflicting;
+        if (!conflicting->hasVreg())
+            *pfixed = true;
         return true;
     }
 
@@ -657,7 +668,7 @@ BacktrackingAllocator::tryAllocateGroupRegister(PhysicalRegister &r, VirtualRegi
 
 bool
 BacktrackingAllocator::tryAllocateRegister(PhysicalRegister &r, LiveInterval *interval,
-                                           bool *success, LiveInterval **pconflicting)
+                                           bool *success, bool *pfixed, LiveInterval **pconflicting)
 {
     *success = false;
 
@@ -692,6 +703,7 @@ BacktrackingAllocator::tryAllocateRegister(PhysicalRegister &r, LiveInterval *in
                     IonSpew(IonSpew_RegAlloc, "%s collides with fixed use [%u,%u>",
                             r.reg.name(), existing.range->from.pos(), existing.range->to.pos());
                 }
+                *pfixed = true;
             }
             return true;
         }
@@ -741,6 +753,35 @@ BacktrackingAllocator::evictInterval(LiveInterval *interval)
     return allocationQueue.insert(QueueItem(interval, priority));
 }
 
+bool
+BacktrackingAllocator::distributeUses(LiveInterval *interval,
+                                      const LiveIntervalVector &newIntervals)
+{
+    JS_ASSERT(newIntervals.length() >= 2);
+
+    // Simple redistribution of uses from an old interval to a set of new
+    // intervals. Intervals are permitted to overlap, in which case this will
+    // assign uses in the overlapping section to the interval with the latest
+    // start position.
+    for (UsePositionIterator iter(interval->usesBegin());
+         iter != interval->usesEnd();
+         iter++)
+    {
+        CodePosition pos = iter->pos;
+        LiveInterval *addInterval = NULL;
+        for (size_t i = 0; i < newIntervals.length(); i++) {
+            LiveInterval *newInterval = newIntervals[i];
+            if (newInterval->covers(pos)) {
+                if (!addInterval || newInterval->start() < addInterval->start())
+                    addInterval = newInterval;
+            }
+        }
+        addInterval->addUse(new UsePosition(iter->use, iter->pos));
+    }
+
+    return true;
+}
+
 bool
 BacktrackingAllocator::split(LiveInterval *interval,
                              const LiveIntervalVector &newIntervals)
@@ -769,30 +810,6 @@ BacktrackingAllocator::split(LiveInterval *interval,
             return false;
     }
 
-    // Redistribute uses from the old interval to the new intervals. Intervals
-    // are permitted to overlap. In such cases, assign the use to either any
-    // minimal interval containing it, otherwise the interval with the latest
-    // start position.
-    for (UsePositionIterator iter(interval->usesBegin());
-         iter != interval->usesEnd();
-         iter++)
-    {
-        CodePosition pos = iter->pos;
-        LiveInterval *addInterval = NULL;
-        for (size_t i = 0; i < newIntervals.length(); i++) {
-            LiveInterval *newInterval = newIntervals[i];
-            if (newInterval->covers(pos)) {
-                if (minimalUse(newInterval, insData[pos].ins())) {
-                    addInterval = newInterval;
-                    break;
-                }
-                if (!addInterval || newInterval->start() < addInterval->start())
-                    addInterval = newInterval;
-            }
-        }
-        addInterval->addUse(new UsePosition(iter->use, iter->pos));
-    }
-
     return true;
 }
 
@@ -939,23 +956,30 @@ BacktrackingAllocator::resolveControlFlow()
         BitSet *live = liveIn[mSuccessor->id()];
 
         for (BitSet::Iterator liveRegId(*live); liveRegId; liveRegId++) {
-            LiveInterval *to = vregs[*liveRegId].intervalFor(inputOf(successor->firstId()));
-            JS_ASSERT(to);
+            VirtualRegister &reg = vregs[*liveRegId];
 
             for (size_t j = 0; j < mSuccessor->numPredecessors(); j++) {
                 LBlock *predecessor = mSuccessor->getPredecessor(j)->lir();
-                LiveInterval *from = vregs[*liveRegId].intervalFor(outputOf(predecessor->lastId()));
-                JS_ASSERT(from);
 
-                if (mSuccessor->numPredecessors() > 1) {
-                    JS_ASSERT(predecessor->mir()->numSuccessors() == 1);
-                    LMoveGroup *moves = predecessor->getExitMoveGroup();
-                    if (!addMove(moves, from, to))
-                        return false;
-                } else {
-                    LMoveGroup *moves = successor->getEntryMoveGroup();
-                    if (!addMove(moves, from, to))
-                        return false;
+                for (size_t k = 0; k < reg.numIntervals(); k++) {
+                    LiveInterval *to = reg.getInterval(k);
+                    if (!to->covers(inputOf(successor->firstId())))
+                        continue;
+                    if (to->covers(outputOf(predecessor->lastId())))
+                        continue;
+
+                    LiveInterval *from = reg.intervalFor(outputOf(predecessor->lastId()));
+
+                    if (mSuccessor->numPredecessors() > 1) {
+                        JS_ASSERT(predecessor->mir()->numSuccessors() == 1);
+                        LMoveGroup *moves = predecessor->getExitMoveGroup();
+                        if (!addMove(moves, from, to))
+                            return false;
+                    } else {
+                        LMoveGroup *moves = successor->getEntryMoveGroup();
+                        if (!addMove(moves, from, to))
+                            return false;
+                    }
                 }
             }
         }
@@ -972,6 +996,38 @@ BacktrackingAllocator::isReusedInput(LUse *use, LInstruction *ins, bool consider
     return false;
 }
 
+bool
+BacktrackingAllocator::isRegisterUse(LUse *use, LInstruction *ins)
+{
+    switch (use->policy()) {
+      case LUse::ANY:
+        return isReusedInput(use, ins);
+
+      case LUse::REGISTER:
+      case LUse::FIXED:
+        return true;
+
+      default:
+        return false;
+    }
+}
+
+bool
+BacktrackingAllocator::isRegisterDefinition(LiveInterval *interval)
+{
+    if (interval->index() != 0)
+        return false;
+
+    VirtualRegister &reg = vregs[interval->vreg()];
+    if (reg.ins()->isPhi())
+        return false;
+
+    if (reg.def()->policy() == LDefinition::PRESET && !reg.def()->output()->isRegister())
+        return false;
+
+    return true;
+}
+
 bool
 BacktrackingAllocator::reifyAllocations()
 {
@@ -1070,32 +1126,34 @@ BacktrackingAllocator::populateSafepoints()
 
             LSafepoint *safepoint = ins->safepoint();
 
-            LiveInterval *interval = reg->intervalFor(inputOf(ins));
-            if (!interval)
-                continue;
+            for (size_t k = 0; k < reg->numIntervals(); k++) {
+                LiveInterval *interval = reg->getInterval(k);
+                if (!interval->covers(inputOf(ins)))
+                    continue;
 
-            LAllocation *a = interval->getAllocation();
-            if (a->isGeneralReg() && ins->isCall())
-                continue;
+                LAllocation *a = interval->getAllocation();
+                if (a->isGeneralReg() && ins->isCall())
+                    continue;
 
-            switch (reg->type()) {
-              case LDefinition::OBJECT:
-                safepoint->addGcPointer(*a);
-                break;
+                switch (reg->type()) {
+                  case LDefinition::OBJECT:
+                    safepoint->addGcPointer(*a);
+                    break;
 #ifdef JS_NUNBOX32
-              case LDefinition::TYPE:
-                safepoint->addNunboxType(i, *a);
-                break;
-              case LDefinition::PAYLOAD:
-                safepoint->addNunboxPayload(i, *a);
-                break;
+                  case LDefinition::TYPE:
+                    safepoint->addNunboxType(i, *a);
+                    break;
+                  case LDefinition::PAYLOAD:
+                    safepoint->addNunboxPayload(i, *a);
+                    break;
 #else
-              case LDefinition::BOX:
-                safepoint->addBoxedValue(*a);
-                break;
+                  case LDefinition::BOX:
+                    safepoint->addBoxedValue(*a);
+                    break;
 #endif
-              default:
-                JS_NOT_REACHED("Bad register type");
+                  default:
+                    JS_NOT_REACHED("Bad register type");
+                }
             }
         }
     }
@@ -1472,7 +1530,9 @@ BacktrackingAllocator::trySplitAcrossHotcode(LiveInterval *interval, bool *succe
         return false;
 
     *success = true;
-    return split(interval, newIntervals) && requeueIntervals(newIntervals);
+    return distributeUses(interval, newIntervals) &&
+        split(interval, newIntervals) &&
+        requeueIntervals(newIntervals);
 }
 
 bool
@@ -1542,7 +1602,9 @@ BacktrackingAllocator::trySplitAfterLastRegisterUse(LiveInterval *interval, bool
         return false;
 
     *success = true;
-    return split(interval, newIntervals) && requeueIntervals(newIntervals);
+    return distributeUses(interval, newIntervals) &&
+        split(interval, newIntervals) &&
+        requeueIntervals(newIntervals);
 }
 
 bool
@@ -1551,70 +1613,18 @@ BacktrackingAllocator::splitAtAllRegisterUses(LiveInterval *interval)
     // Split this interval so that all its register uses become minimal
     // intervals and allow the vreg to be spilled throughout its range.
 
-    Vector<LiveInterval::Range, 4, SystemAllocPolicy> registerUses;
+    LiveIntervalVector newIntervals;
     uint32_t vreg = interval->vreg();
 
     CodePosition spillStart = interval->start();
-    if (interval->index() == 0) {
+    if (isRegisterDefinition(interval)) {
         // Treat the definition of the interval as a register use so that it
-        // can be split and spilled ASAP. One issue to watch for:
-        //
-        // - Parameters cannot be spilled immediately, as arguments checks
-        //   assume no movements occur between a script's LParameters and its
-        //   following LStart. It's pointless to do such spills anyways, as the
-        //   vreg is already on the stack.
-        VirtualRegister &reg = vregs[vreg];
-        if (!reg.ins()->isPhi() &&
-            (reg.def()->policy() != LDefinition::PRESET ||
-             reg.def()->output()->isRegister()))
-        {
-            CodePosition from = interval->start();
-            CodePosition to = minimalDefEnd(reg.ins()).next();
-            if (!registerUses.append(LiveInterval::Range(from, to)))
-                return false;
-            spillStart = to;
-        }
-    }
-
-    for (UsePositionIterator iter(interval->usesBegin());
-         iter != interval->usesEnd();
-         iter++)
-    {
-        LUse *use = iter->use;
-        LInstruction *ins = insData[iter->pos].ins();
-
-        bool isRegister = false;
-        switch (use->policy()) {
-          case LUse::ANY:
-            isRegister = isReusedInput(iter->use, ins);
-            break;
-
-          case LUse::REGISTER:
-          case LUse::FIXED:
-            isRegister = true;
-            break;
-
-          default:
-            break;
-        }
-
-        if (isRegister) {
-            // For register uses which are not useRegisterAtStart, pick an
-            // interval that covers both the instruction's input and output, so
-            // that the register is not reused for an output.
-            if (!registerUses.append(LiveInterval::Range(inputOf(ins), iter->pos.next())))
-                return false;
-        }
-    }
-
-    LiveIntervalVector newIntervals;
-
-    for (size_t i = 0; i < registerUses.length(); i++) {
-        // Watch for duplicate register use positions.
-        if (i > 0 && registerUses[i].from == registerUses[i - 1].from)
-            continue;
-        if (!addLiveInterval(newIntervals, vreg, registerUses[i].from, registerUses[i].to))
+        // can be split and spilled ASAP.
+        CodePosition from = interval->start();
+        CodePosition to = minimalDefEnd(insData[from].ins()).next();
+        if (!addLiveInterval(newIntervals, vreg, from, to))
             return false;
+        spillStart = to;
     }
 
     LiveInterval *spillInterval = new LiveInterval(vreg, 0);
@@ -1624,6 +1634,149 @@ BacktrackingAllocator::splitAtAllRegisterUses(LiveInterval *interval)
         if (!spillInterval->addRange(from, range->to))
             return false;
     }
+
+    for (UsePositionIterator iter(interval->usesBegin());
+         iter != interval->usesEnd();
+         iter++)
+    {
+        LInstruction *ins = insData[iter->pos].ins();
+        if (iter->pos < spillStart) {
+            newIntervals.back()->addUse(new UsePosition(iter->use, iter->pos));
+        } else if (isRegisterUse(iter->use, ins)) {
+            // For register uses which are not useRegisterAtStart, pick an
+            // interval that covers both the instruction's input and output, so
+            // that the register is not reused for an output.
+            CodePosition from = inputOf(ins);
+            CodePosition to = iter->pos.next();
+
+            // Watch for duplicate register use positions.
+            if (newIntervals.empty() || newIntervals.back()->end() != to) {
+                if (!addLiveInterval(newIntervals, vreg, from, to))
+                    return false;
+            }
+
+            newIntervals.back()->addUse(new UsePosition(iter->use, iter->pos));
+        } else {
+            spillInterval->addUse(new UsePosition(iter->use, iter->pos));
+        }
+    }
+
+    if (!newIntervals.append(spillInterval))
+        return false;
+
+    return split(interval, newIntervals) && requeueIntervals(newIntervals);
+}
+
+bool
+BacktrackingAllocator::splitAcrossCalls(LiveInterval *interval)
+{
+    // Split the interval to separate register uses and non-register uses and
+    // allow the vreg to be spilled across its range. Unlike splitAtAllRegisterUses,
+    // consolidate any register uses which have no intervening calls into the
+    // same resulting interval.
+
+    // Don't spill the interval until after the end of its definition.
+    CodePosition spillStart = interval->start();
+    if (isRegisterDefinition(interval))
+        spillStart = minimalDefEnd(insData[interval->start()].ins()).next();
+
+    // Find the locations of all calls in the interval's range. Fixed intervals
+    // are introduced by buildLivenessInfo only for calls when allocating for
+    // the backtracking allocator.
+    Vector<CodePosition, 4, SystemAllocPolicy> callPositions;
+    for (size_t i = 0; i < fixedIntervalsUnion->numRanges(); i++) {
+        const LiveInterval::Range *range = fixedIntervalsUnion->getRange(i);
+        if (interval->covers(range->from) && spillStart < range->from) {
+            if (!callPositions.append(range->from))
+                return false;
+        }
+    }
+    JS_ASSERT(callPositions.length());
+
+    uint32_t vreg = interval->vreg();
+
+    LiveInterval *spillInterval = new LiveInterval(vreg, 0);
+    for (size_t i = 0; i < interval->numRanges(); i++) {
+        const LiveInterval::Range *range = interval->getRange(i);
+        CodePosition from = range->from < spillStart ? spillStart : range->from;
+        if (!spillInterval->addRange(from, range->to))
+            return false;
+    }
+
+    LiveIntervalVector newIntervals;
+
+    CodePosition lastRegisterUse;
+    if (spillStart != interval->start()) {
+        LiveInterval *newInterval = new LiveInterval(vreg, 0);
+        if (!newIntervals.append(newInterval))
+            return false;
+        lastRegisterUse = interval->start();
+    }
+
+    int activeCallPosition = callPositions.length() - 1;
+    for (UsePositionIterator iter(interval->usesBegin()); iter != interval->usesEnd(); iter++) {
+        LInstruction *ins = insData[iter->pos].ins();
+        if (iter->pos < spillStart) {
+            newIntervals.back()->addUse(new UsePosition(iter->use, iter->pos));
+        } else if (isRegisterUse(iter->use, ins)) {
+            bool useNewInterval = false;
+            if (lastRegisterUse.pos() == 0) {
+                useNewInterval = true;
+            } else {
+                // Place this register use into a different interval from the
+                // last one if there are any calls between the two uses or if
+                // the register uses are in different subranges of the original
+                // interval.
+                for (; activeCallPosition >= 0; activeCallPosition--) {
+                    CodePosition pos = callPositions[activeCallPosition];
+                    if (iter->pos < pos)
+                        break;
+                    if (lastRegisterUse < pos) {
+                        useNewInterval = true;
+                        break;
+                    }
+                }
+                if (!useNewInterval) {
+                    for (size_t i = 0; i < interval->numRanges(); i++) {
+                        const LiveInterval::Range *range = interval->getRange(i);
+                        if (range->from <= lastRegisterUse && range->to <= iter->pos) {
+                            useNewInterval = true;
+                            break;
+                        }
+                    }
+                }
+            }
+            if (useNewInterval) {
+                LiveInterval *newInterval = new LiveInterval(vreg, 0);
+                if (!newIntervals.append(newInterval))
+                    return false;
+            }
+            newIntervals.back()->addUse(new UsePosition(iter->use, iter->pos));
+            lastRegisterUse = iter->pos;
+        } else {
+            spillInterval->addUse(new UsePosition(iter->use, iter->pos));
+        }
+    }
+
+    // Compute ranges for each new interval that cover all its uses.
+    for (size_t i = 0; i < newIntervals.length(); i++) {
+        LiveInterval *newInterval = newIntervals[i];
+        CodePosition start, end;
+        if (i == 0 && spillStart != interval->start()) {
+            start = interval->start();
+            end = spillStart;
+        } else {
+            start = inputOf(insData[newInterval->usesBegin()->pos].ins());
+        }
+        for (UsePositionIterator iter(newInterval->usesBegin());
+             iter != newInterval->usesEnd();
+             iter++) {
+            end = iter->pos.next();
+        }
+        if (!newInterval->addRange(start, end))
+            return false;
+    }
+
     if (!newIntervals.append(spillInterval))
         return false;
 
diff --git a/js/src/ion/BacktrackingAllocator.h b/js/src/ion/BacktrackingAllocator.h
index ebbbe95ee52f..ccf0a2e611fb 100644
--- a/js/src/ion/BacktrackingAllocator.h
+++ b/js/src/ion/BacktrackingAllocator.h
@@ -187,15 +187,18 @@ class BacktrackingAllocator : public LiveRangeAllocator<BacktrackingVirtualRegis
     bool processGroup(VirtualRegisterGroup *group);
     bool setIntervalRequirement(LiveInterval *interval);
     bool tryAllocateRegister(PhysicalRegister &r, LiveInterval *interval,
-                             bool *success, LiveInterval **pconflicting);
+                             bool *success, bool *pfixed, LiveInterval **pconflicting);
     bool tryAllocateGroupRegister(PhysicalRegister &r, VirtualRegisterGroup *group,
-                                  bool *psuccess, LiveInterval **pconflicting);
+                                  bool *psuccess, bool *pfixed, LiveInterval **pconflicting);
     bool evictInterval(LiveInterval *interval);
+    bool distributeUses(LiveInterval *interval, const LiveIntervalVector &newIntervals);
     bool split(LiveInterval *interval, const LiveIntervalVector &newIntervals);
     bool requeueIntervals(const LiveIntervalVector &newIntervals);
     void spill(LiveInterval *interval);
 
     bool isReusedInput(LUse *use, LInstruction *ins, bool considerCopy = false);
+    bool isRegisterUse(LUse *use, LInstruction *ins);
+    bool isRegisterDefinition(LiveInterval *interval);
     bool addLiveInterval(LiveIntervalVector &intervals, uint32_t vreg,
                          CodePosition from, CodePosition to);
 
@@ -226,6 +229,7 @@ class BacktrackingAllocator : public LiveRangeAllocator<BacktrackingVirtualRegis
     bool trySplitAcrossHotcode(LiveInterval *interval, bool *success);
     bool trySplitAfterLastRegisterUse(LiveInterval *interval, bool *success);
     bool splitAtAllRegisterUses(LiveInterval *interval);
+    bool splitAcrossCalls(LiveInterval *interval);
 };
 
 } // namespace ion
diff --git a/js/src/ion/CodeGenerator.cpp b/js/src/ion/CodeGenerator.cpp
index 8d7474104241..2fd13922f2f6 100644
--- a/js/src/ion/CodeGenerator.cpp
+++ b/js/src/ion/CodeGenerator.cpp
@@ -970,7 +970,7 @@ CodeGenerator::visitCallGetIntrinsicValue(LCallGetIntrinsicValue *lir)
     return callVM(GetIntrinsicValueInfo, lir);
 }
 
-typedef bool (*InvokeFunctionFn)(JSContext *, JSFunction *, uint32_t, Value *, Value *);
+typedef bool (*InvokeFunctionFn)(JSContext *, HandleFunction, uint32_t, Value *, Value *);
 static const VMFunction InvokeFunctionInfo = FunctionInfo<InvokeFunctionFn>(InvokeFunction);
 
 bool
@@ -1106,7 +1106,7 @@ CodeGenerator::visitCallKnown(LCallKnown *call)
     Register calleereg = ToRegister(call->getFunction());
     Register objreg    = ToRegister(call->getTempObject());
     uint32_t unusedStack = StackOffsetOfPassedArg(call->argslot());
-    JSFunction *target = call->getSingleTarget();
+    RootedFunction target(cx, call->getSingleTarget());
     Label end, invoke;
 
     // Native single targets are handled by LCallNative.
@@ -1117,7 +1117,7 @@ CodeGenerator::visitCallKnown(LCallKnown *call)
     masm.checkStackAlignment();
 
     // Make sure the function has a JSScript
-    if (target->isInterpretedLazy() && !target->getOrCreateScript(cx))
+    if (target->isInterpretedLazy() && !JSFunction::getOrCreateScript(cx, target))
         return false;
 
     // If the function is known to be uncompilable, only emit the call to InvokeFunction.
diff --git a/js/src/ion/Ion.cpp b/js/src/ion/Ion.cpp
index 88a1f528c3a6..821bcbfb348c 100644
--- a/js/src/ion/Ion.cpp
+++ b/js/src/ion/Ion.cpp
@@ -1072,8 +1072,8 @@ public:
         return SequentialExecution;
     }
 
-    bool compile(IonBuilder *builder, MIRGraph *graph,
-                 AutoDestroyAllocator &autoDestroy);
+    AbortReason compile(IonBuilder *builder, MIRGraph *graph,
+                        AutoDestroyAllocator &autoDestroy);
 };
 
 void
@@ -1139,7 +1139,7 @@ AttachFinishedCompilations(JSContext *cx)
 static const size_t BUILDER_LIFO_ALLOC_PRIMARY_CHUNK_SIZE = 1 << 12;
 
 template <typename CompileContext>
-static bool
+static AbortReason
 IonCompile(JSContext *cx, HandleScript script, HandleFunction fun, jsbytecode *osrPc, bool constructing,
            CompileContext &compileContext)
 {
@@ -1153,50 +1153,74 @@ IonCompile(JSContext *cx, HandleScript script, HandleFunction fun, jsbytecode *o
 
     LifoAlloc *alloc = cx->new_<LifoAlloc>(BUILDER_LIFO_ALLOC_PRIMARY_CHUNK_SIZE);
     if (!alloc)
-        return false;
+        return AbortReason_Alloc;
 
     AutoDestroyAllocator autoDestroy(alloc);
 
     TempAllocator *temp = alloc->new_<TempAllocator>(alloc);
     if (!temp)
-        return false;
+        return AbortReason_Alloc;
 
     IonContext ictx(cx, cx->compartment, temp);
 
     if (!cx->compartment->ensureIonCompartmentExists(cx))
-        return false;
+        return AbortReason_Alloc;
 
     MIRGraph *graph = alloc->new_<MIRGraph>(temp);
     ExecutionMode executionMode = compileContext.executionMode();
     CompileInfo *info = alloc->new_<CompileInfo>(script, fun, osrPc, constructing,
                                                  executionMode);
     if (!info)
-        return false;
+        return AbortReason_Alloc;
 
     types::AutoEnterTypeInference enter(cx, true);
     TypeInferenceOracle oracle;
 
     if (!oracle.init(cx, script))
-        return false;
+        return AbortReason_Disable;
 
     AutoFlushCache afc("IonCompile");
 
     types::AutoEnterCompilation enterCompiler(cx, CompilerOutputKind(executionMode));
     if (!enterCompiler.init(script, false, 0))
-        return false;
+        return AbortReason_Disable;
 
     AutoTempAllocatorRooter root(cx, temp);
 
     IonBuilder *builder = alloc->new_<IonBuilder>(cx, temp, graph, &oracle, info);
-    if (!compileContext.compile(builder, graph, autoDestroy)) {
-        IonSpew(IonSpew_Abort, "IM Compilation failed.");
-        return false;
-    }
+    if (!builder)
+        return AbortReason_Alloc;
 
-    return true;
+    AbortReason abortReason  = compileContext.compile(builder, graph, autoDestroy);
+    if (abortReason != AbortReason_NoAbort)
+        IonSpew(IonSpew_Abort, "IM Compilation failed.");
+
+    return abortReason;
 }
 
-bool
+static inline bool
+OffThreadCompilationEnabled(JSContext *cx)
+{
+    return js_IonOptions.parallelCompilation
+        && cx->runtime->useHelperThreads()
+        && cx->runtime->helperThreadCount() != 0;
+}
+
+static inline bool
+OffThreadCompilationAvailable(JSContext *cx)
+{
+    // Even if off thread compilation is enabled, compilation must still occur
+    // on the main thread in some cases. Do not compile off thread during an
+    // incremental GC, as this may trip incremental read barriers. Also skip
+    // off thread compilation if script execution is being profiled, as
+    // CodeGenerator::maybeCreateScriptCounts will not attach script profiles
+    // when running off thread.
+    return OffThreadCompilationEnabled(cx)
+        && cx->runtime->gcIncrementalState == gc::NO_INCREMENTAL
+        && !cx->runtime->profilingScripts;
+}
+
+AbortReason
 SequentialCompileContext::compile(IonBuilder *builder, MIRGraph *graph,
                                   AutoDestroyAllocator &autoDestroy)
 {
@@ -1208,38 +1232,30 @@ SequentialCompileContext::compile(IonBuilder *builder, MIRGraph *graph,
 
     if (!builder->build()) {
         IonSpew(IonSpew_Abort, "Builder failed to build.");
-        return false;
+        return builder->abortReason();
     }
     builder->clearForBackEnd();
 
-    // Try to compile the script off thread, if possible. Compilation cannot be
-    // performed off thread during an incremental GC, as doing so may trip
-    // incremental read barriers. Also skip off thread compilation if script
-    // execution is being profiled, as CodeGenerator::maybeCreateScriptCounts
-    // will not attach script profiles when running off thread.
-    if (js_IonOptions.parallelCompilation &&
-        OffThreadCompilationAvailable(cx) &&
-        cx->runtime->gcIncrementalState == gc::NO_INCREMENTAL &&
-        !cx->runtime->profilingScripts)
-    {
+    // If possible, compile the script off thread.
+    if (OffThreadCompilationAvailable(cx)) {
         builder->script()->ion = ION_COMPILING_SCRIPT;
 
         if (!StartOffThreadIonCompile(cx, builder)) {
             IonSpew(IonSpew_Abort, "Unable to start off-thread ion compilation.");
-            return false;
+            return AbortReason_Alloc;
         }
 
         // The allocator and associated data will be destroyed after being
         // processed in the finishedOffThreadCompilations list.
         autoDestroy.cancel();
 
-        return true;
+        return AbortReason_NoAbort;
     }
 
     CodeGenerator *codegen = CompileBackEnd(builder);
     if (!codegen) {
         IonSpew(IonSpew_Abort, "Failed during back-end compilation.");
-        return false;
+        return AbortReason_Disable;
     }
 
     bool success = codegen->link();
@@ -1247,19 +1263,30 @@ SequentialCompileContext::compile(IonBuilder *builder, MIRGraph *graph,
 
     IonSpewEndFunction();
 
-    return success;
+    return success ? AbortReason_NoAbort : AbortReason_Disable;
 }
 
-bool
+MethodStatus
 TestIonCompile(JSContext *cx, HandleScript script, HandleFunction fun, jsbytecode *osrPc, bool constructing)
 {
     SequentialCompileContext compileContext;
-    if (!IonCompile(cx, script, fun, osrPc, constructing, compileContext)) {
+
+    AbortReason reason = IonCompile(cx, script, fun, osrPc, constructing, compileContext);
+
+    if (reason == AbortReason_Alloc)
+        return Method_Skipped;
+
+    if (reason == AbortReason_Inlining)
+        return Method_Skipped;
+
+    if (reason == AbortReason_Disable) {
         if (!cx->isExceptionPending())
             ForbidCompilation(cx, script);
-        return false;
+        return Method_CantCompile;
     }
-    return true;
+
+    JS_ASSERT(reason == AbortReason_NoAbort);
+    return Method_Compiled;
 }
 
 static bool
@@ -1319,27 +1346,47 @@ CheckScript(UnrootedScript script)
     return true;
 }
 
-static bool
-CheckScriptSize(UnrootedScript script)
+static MethodStatus
+CheckScriptSize(JSContext *cx, UnrootedScript script)
 {
     if (!js_IonOptions.limitScriptSize)
-        return true;
+        return Method_Compiled;
 
-    static const uint32_t MAX_SCRIPT_SIZE = 2000;
+    // Longer scripts can only be compiled off thread, as these compilations
+    // can be expensive and stall the main thread for too long.
+    static const uint32_t MAX_MAIN_THREAD_SCRIPT_SIZE = 2000;
+    static const uint32_t MAX_OFF_THREAD_SCRIPT_SIZE = 20000;
     static const uint32_t MAX_LOCALS_AND_ARGS = 256;
 
-    if (script->length > MAX_SCRIPT_SIZE) {
+    if (script->length > MAX_OFF_THREAD_SCRIPT_SIZE) {
         IonSpew(IonSpew_Abort, "Script too large (%u bytes)", script->length);
-        return false;
+        return Method_CantCompile;
+    }
+
+    if (script->length > MAX_MAIN_THREAD_SCRIPT_SIZE) {
+        if (OffThreadCompilationEnabled(cx)) {
+            // Even if off thread compilation is enabled, there are cases where
+            // compilation must still occur on the main thread. Don't compile
+            // in these cases (except when profiling scripts, as compilations
+            // occurring with profiling should reflect those without), but do
+            // not forbid compilation so that the script may be compiled later.
+            if (!OffThreadCompilationAvailable(cx) && !cx->runtime->profilingScripts) {
+                IonSpew(IonSpew_Abort, "Script too large for main thread, skipping (%u bytes)", script->length);
+                return Method_Skipped;
+            }
+        } else {
+            IonSpew(IonSpew_Abort, "Script too large (%u bytes)", script->length);
+            return Method_CantCompile;
+        }
     }
 
     uint32_t numLocalsAndArgs = analyze::TotalSlots(script);
     if (numLocalsAndArgs > MAX_LOCALS_AND_ARGS) {
         IonSpew(IonSpew_Abort, "Too many locals and arguments (%u)", numLocalsAndArgs);
-        return false;
+        return Method_CantCompile;
     }
 
-    return true;
+    return Method_Compiled;
 }
 
 static MethodStatus
@@ -1353,11 +1400,17 @@ Compile(JSContext *cx, HandleScript script, HandleFunction fun, jsbytecode *osrP
         return Method_CantCompile;
     }
 
-    if (!CheckScript(script) || !CheckScriptSize(script)) {
+    if (!CheckScript(script)) {
         IonSpew(IonSpew_Abort, "Aborted compilation of %s:%d", script->filename, script->lineno);
         return Method_CantCompile;
     }
 
+    MethodStatus status = CheckScriptSize(cx, script);
+    if (status != Method_Compiled) {
+        IonSpew(IonSpew_Abort, "Aborted compilation of %s:%d", script->filename, script->lineno);
+        return status;
+    }
+
     if (script->ion) {
         if (!script->ion->method())
             return Method_CantCompile;
@@ -1375,10 +1428,12 @@ Compile(JSContext *cx, HandleScript script, HandleFunction fun, jsbytecode *osrP
     }
 
     SequentialCompileContext compileContext;
-    if (!IonCompile(cx, script, fun, osrPc, constructing, compileContext))
+
+    AbortReason reason = IonCompile(cx, script, fun, osrPc, constructing, compileContext);
+    if (reason == AbortReason_Disable)
         return Method_CantCompile;
 
-    // Compilation succeeded, but we invalidated right away.
+    // Compilation succeeded or we invalidated right away or an inlining/alloc abort
     return script->hasIonScript() ? Method_Compiled : Method_Skipped;
 }
 
diff --git a/js/src/ion/Ion.h b/js/src/ion/Ion.h
index 2fcb86e10b2c..1eabb0525a94 100644
--- a/js/src/ion/Ion.h
+++ b/js/src/ion/Ion.h
@@ -211,6 +211,13 @@ enum MethodStatus
     Method_Compiled
 };
 
+enum AbortReason {
+    AbortReason_Alloc,
+    AbortReason_Inlining,
+    AbortReason_Disable,
+    AbortReason_NoAbort
+};
+
 // An Ion context is needed to enter into either an Ion method or an instance
 // of the Ion compiler. It points to a temporary allocator and the active
 // JSContext, either of which may be NULL, and the active compartment, which
@@ -296,7 +303,7 @@ class CodeGenerator;
 CodeGenerator *CompileBackEnd(MIRGenerator *mir);
 void AttachFinishedCompilations(JSContext *cx);
 void FinishOffThreadBuilder(IonBuilder *builder);
-bool TestIonCompile(JSContext *cx, HandleScript script, HandleFunction fun, jsbytecode *osrPc, bool constructing);
+MethodStatus TestIonCompile(JSContext *cx, HandleScript script, HandleFunction fun, jsbytecode *osrPc, bool constructing);
 
 static inline bool IsEnabled(JSContext *cx)
 {
diff --git a/js/src/ion/IonBuilder.cpp b/js/src/ion/IonBuilder.cpp
index 7c39cd6eb758..164267aeb574 100644
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -35,6 +35,7 @@ IonBuilder::IonBuilder(JSContext *cx, TempAllocator *temp, MIRGraph *graph,
     backgroundCodegen_(NULL),
     recompileInfo(cx->compartment->types.compiledInfo),
     cx(cx),
+    abortReason_(AbortReason_Disable),
     loopDepth_(loopDepth),
     callerResumePoint_(NULL),
     callerBuilder_(NULL),
@@ -346,6 +347,7 @@ IonBuilder::build()
         return false;
 
     JS_ASSERT(loopDepth_ == 0);
+    abortReason_ = AbortReason_NoAbort;
     return true;
 }
 
@@ -2910,8 +2912,16 @@ IonBuilder::jsop_call_inline(HandleFunction callee, uint32_t argc, bool construc
     }
 
     // Build the graph.
-    if (!inlineBuilder.buildInline(this, inlineResumePoint, thisDefn, argv))
+    if (!inlineBuilder.buildInline(this, inlineResumePoint, thisDefn, argv)) {
+        JS_ASSERT(calleeScript->hasAnalysis());
+
+        // Inlining the callee failed. Disable inlining the function
+        if (inlineBuilder.abortReason_ == AbortReason_Disable)
+            calleeScript->analysis()->setIonUninlineable();
+
+        abortReason_ = AbortReason_Inlining;
         return false;
+    }
 
     MIRGraphExits &exits = *inlineBuilder.graph().exitAccumulator();
 
@@ -6260,6 +6270,13 @@ IonBuilder::getPropTryCommonGetter(bool *emitted, HandleId id, types::StackTypeS
         return true;
     }
 
+    // Don't call the getter with a primitive value.
+    if (unaryTypes.inTypes->getKnownTypeTag() != JSVAL_TYPE_OBJECT) {
+        MGuardObject *guardObj = MGuardObject::New(obj);
+        current->add(guardObj);
+        obj = guardObj;
+    }
+
     // Spoof stack to expected state for call.
     pushConstant(ObjectValue(*commonGetter));
 
@@ -6413,6 +6430,13 @@ IonBuilder::jsop_setprop(HandlePropertyName name)
             return resumeAfter(set);
         }
 
+        // Don't call the setter with a primitive value.
+        if (types->getKnownTypeTag() != JSVAL_TYPE_OBJECT) {
+            MGuardObject *guardObj = MGuardObject::New(obj);
+            current->add(guardObj);
+            obj = guardObj;
+        }
+
         // Dummy up the stack, as in getprop
         pushConstant(ObjectValue(*setter));
 
diff --git a/js/src/ion/IonBuilder.h b/js/src/ion/IonBuilder.h
index 0a490503aa96..e756682e40c3 100644
--- a/js/src/ion/IonBuilder.h
+++ b/js/src/ion/IonBuilder.h
@@ -475,8 +475,11 @@ class IonBuilder : public MIRGenerator
     CodeGenerator *backgroundCodegen() const { return backgroundCodegen_; }
     void setBackgroundCodegen(CodeGenerator *codegen) { backgroundCodegen_ = codegen; }
 
+    AbortReason abortReason() { return abortReason_; }
+
   private:
     JSContext *cx;
+    AbortReason abortReason_;
 
     jsbytecode *pc;
     MBasicBlock *current;
diff --git a/js/src/ion/Lowering.cpp b/js/src/ion/Lowering.cpp
index 47b79ec14d67..ef294b29648d 100644
--- a/js/src/ion/Lowering.cpp
+++ b/js/src/ion/Lowering.cpp
@@ -300,9 +300,20 @@ LIRGenerator::visitCall(MCall *call)
     // Call known functions.
     if (target) {
         if (target->isNative()) {
-            LCallNative *lir = new LCallNative(argslot, tempFixed(CallTempReg0),
-                                               tempFixed(CallTempReg1), tempFixed(CallTempReg2),
-                                               tempFixed(CallTempReg3));
+            Register cxReg, numReg, vpReg, tmpReg;
+            GetTempRegForIntArg(0, 0, &cxReg);
+            GetTempRegForIntArg(1, 0, &numReg);
+            GetTempRegForIntArg(2, 0, &vpReg);
+
+            // Even though this is just a temp reg, use the same API to avoid
+            // register collisions.
+            mozilla::DebugOnly<bool> ok = GetTempRegForIntArg(3, 0, &tmpReg);
+            MOZ_ASSERT(ok, "How can we not have four temp registers?");
+
+            LCallNative *lir = new LCallNative(argslot, tempFixed(cxReg),
+                                               tempFixed(numReg),
+                                               tempFixed(vpReg),
+                                               tempFixed(tmpReg));
             return (defineReturn(lir, call) && assignSafepoint(lir, call));
         }
 
diff --git a/js/src/ion/VMFunctions.cpp b/js/src/ion/VMFunctions.cpp
index 745f6e3f4eae..480c45af2f9e 100644
--- a/js/src/ion/VMFunctions.cpp
+++ b/js/src/ion/VMFunctions.cpp
@@ -47,14 +47,14 @@ ShouldMonitorReturnType(JSFunction *fun)
 }
 
 bool
-InvokeFunction(JSContext *cx, JSFunction *fun, uint32_t argc, Value *argv, Value *rval)
+InvokeFunction(JSContext *cx, HandleFunction fun, uint32_t argc, Value *argv, Value *rval)
 {
-    Value fval = ObjectValue(*fun);
+    AssertCanGC();
 
     // In order to prevent massive bouncing between Ion and JM, see if we keep
     // hitting functions that are uncompilable.
     if (fun->isInterpreted()) {
-        if (fun->isInterpretedLazy() && !fun->getOrCreateScript(cx))
+        if (fun->isInterpretedLazy() && !JSFunction::getOrCreateScript(cx, fun))
             return false;
         if (!fun->nonLazyScript()->canIonCompile()) {
             UnrootedScript script = GetTopIonJSScript(cx);
@@ -87,7 +87,7 @@ InvokeFunction(JSContext *cx, JSFunction *fun, uint32_t argc, Value *argv, Value
     Value *argvWithoutThis = argv + 1;
 
     // Run the function in the interpreter.
-    bool ok = Invoke(cx, thisv, fval, argc, argvWithoutThis, rval);
+    bool ok = Invoke(cx, thisv, ObjectValue(*fun), argc, argvWithoutThis, rval);
     if (ok && needsMonitor)
         types::TypeScript::Monitor(cx, *rval);
 
diff --git a/js/src/ion/VMFunctions.h b/js/src/ion/VMFunctions.h
index e09e23d22611..36925635838a 100644
--- a/js/src/ion/VMFunctions.h
+++ b/js/src/ion/VMFunctions.h
@@ -410,7 +410,7 @@ class AutoDetectInvalidation
     }
 };
 
-bool InvokeFunction(JSContext *cx, JSFunction *fun, uint32_t argc, Value *argv, Value *rval);
+bool InvokeFunction(JSContext *cx, HandleFunction fun, uint32_t argc, Value *argv, Value *rval);
 JSObject *NewGCThing(JSContext *cx, gc::AllocKind allocKind, size_t thingSize);
 
 bool CheckOverRecursed(JSContext *cx);
diff --git a/js/src/ion/arm/CodeGenerator-arm.cpp b/js/src/ion/arm/CodeGenerator-arm.cpp
index 887153e3534d..4bcf59c0aa15 100644
--- a/js/src/ion/arm/CodeGenerator-arm.cpp
+++ b/js/src/ion/arm/CodeGenerator-arm.cpp
@@ -1163,7 +1163,7 @@ CodeGeneratorARM::visitCompareD(LCompareD *comp)
     Assembler::DoubleCondition cond = JSOpToDoubleCondition(comp->mir()->jsop());
     masm.compareDouble(lhs, rhs);
     emitSet(Assembler::ConditionFromDoubleCondition(cond), ToRegister(comp->output()));
-    return false;
+    return true;
 }
 
 bool
diff --git a/js/src/jit-test/tests/basic/bug826581.js b/js/src/jit-test/tests/basic/bug826581.js
new file mode 100644
index 000000000000..bfeade610663
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug826581.js
@@ -0,0 +1,12 @@
+// Don't crash.
+
+try {
+    x = "          ()    ";
+    for (var y = 0; y < 19; y++) {
+        x += x;
+    }
+} catch (e) {}
+
+try {
+	"".replace(x, "", "gy");
+} catch (e) { }
diff --git a/js/src/jit-test/tests/debug/Frame-onPop-generators-01.js b/js/src/jit-test/tests/debug/Frame-onPop-generators-01.js
new file mode 100644
index 000000000000..c4f3cdbde367
--- /dev/null
+++ b/js/src/jit-test/tests/debug/Frame-onPop-generators-01.js
@@ -0,0 +1,20 @@
+// Returning {throw:} from an onPop handler when yielding works and
+// does not close the generator-iterator.
+
+load(libdir + "asserts.js");
+
+var g = newGlobal('new-compartment');
+var dbg = new Debugger;
+var gw = dbg.addDebuggee(g);
+dbg.onDebuggerStatement = function handleDebugger(frame) {
+    frame.onPop = function (c) {
+        return {throw: "fit"};
+    };
+};
+g.eval("function g() { for (var i = 0; i < 10; i++) { debugger; yield i; } }");
+g.eval("var it = g();");
+var rv = gw.evalInGlobal("it.next();");
+assertEq(rv.throw, "fit");
+
+dbg.enabled = false;
+assertEq(g.it.next(), 1);
diff --git a/js/src/jit-test/tests/debug/Frame-onPop-generators-02.js b/js/src/jit-test/tests/debug/Frame-onPop-generators-02.js
new file mode 100644
index 000000000000..038b8ab51c04
--- /dev/null
+++ b/js/src/jit-test/tests/debug/Frame-onPop-generators-02.js
@@ -0,0 +1,17 @@
+// Throwing an exception from an onPop handler when yielding terminates the debuggee
+// but does not close the generator-iterator.
+
+var g = newGlobal('new-compartment');
+var dbg = new Debugger;
+var gw = dbg.addDebuggee(g);
+dbg.onDebuggerStatement = function handleDebugger(frame) {
+    frame.onPop = function (c) {
+        throw "fit";
+    };
+};
+g.eval("function g() { for (var i = 0; i < 10; i++) { debugger; yield i; } }");
+g.eval("var it = g();");
+assertEq(gw.evalInGlobal("it.next();"), null);
+
+dbg.enabled = false;
+assertEq(g.it.next(), 1);
diff --git a/js/src/jit-test/tests/debug/bug-826669.js b/js/src/jit-test/tests/debug/bug-826669.js
new file mode 100644
index 000000000000..afb4c61e438b
--- /dev/null
+++ b/js/src/jit-test/tests/debug/bug-826669.js
@@ -0,0 +1,7 @@
+gczeal(9, 2)
+var g1 = newGlobal('new-compartment');
+var g2 = newGlobal('new-compartment');
+var dbg = new Debugger();
+var g1w = dbg.addDebuggee(g1);
+g1.eval('function f() {}');
+scripts = dbg.findScripts({});
diff --git a/js/src/jit-test/tests/ion/bug827659-1.js b/js/src/jit-test/tests/ion/bug827659-1.js
new file mode 100644
index 000000000000..f56ef46e3cc5
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug827659-1.js
@@ -0,0 +1,11 @@
+function f() {
+    return y.byteOffset;
+}
+var y;
+for (var j = 0; j < 1; ++j) {
+    y = new Float32Array();
+}
+f();
+y = 0;
+assertEq(f(), undefined);
+assertEq(f(), undefined);
diff --git a/js/src/jit-test/tests/ion/bug827659-2.js b/js/src/jit-test/tests/ion/bug827659-2.js
new file mode 100644
index 000000000000..f223a6a6d5c3
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug827659-2.js
@@ -0,0 +1,15 @@
+function f(x) {
+    return x["__proto__"]
+}
+var res = 0;
+for each(a in [{}, null]) {
+    try {
+        f(a);
+	res += 20;
+    } catch (e) {
+	assertEq(e instanceof TypeError, true);
+	assertEq(e.message.indexOf("is null") > 0, true);
+	res += 50;
+    }
+}
+assertEq(res, 70);
diff --git a/js/src/jsanalyze.h b/js/src/jsanalyze.h
index df514ad5fafd..e0acde491e7c 100644
--- a/js/src/jsanalyze.h
+++ b/js/src/jsanalyze.h
@@ -884,6 +884,7 @@ class ScriptAnalysis
     bool failed() const { return hadFailure; }
     bool ionInlineable() const { return isIonInlineable; }
     bool ionInlineable(uint32_t argc) const { return isIonInlineable && argc == script_->function()->nargs; }
+    void setIonUninlineable() { isIonInlineable = false; }
     bool jaegerInlineable() const { return isJaegerInlineable; }
     bool jaegerInlineable(uint32_t argc) const { return isJaegerInlineable && argc == script_->function()->nargs; }
     bool jaegerCompileable() { return isJaegerCompileable; }
diff --git a/js/src/jsapi-tests/testOOM.cpp b/js/src/jsapi-tests/testOOM.cpp
index 24cc0e4eb1ef..39216f593780 100644
--- a/js/src/jsapi-tests/testOOM.cpp
+++ b/js/src/jsapi-tests/testOOM.cpp
@@ -8,9 +8,7 @@
 
 BEGIN_TEST(testOOM)
 {
-    JSString *jsstr = JS_ValueToString(cx, INT_TO_JSVAL(9));
-    jsval tmp = STRING_TO_JSVAL(jsstr);
-    JS_SetProperty(cx, global, "rootme", &tmp);
+    js::RootedString jsstr(cx, JS_ValueToString(cx, INT_TO_JSVAL(9)));
     mozilla::DebugOnly<const jschar *> s = JS_GetStringCharsZ(cx, jsstr);
     JS_ASSERT(s[0] == '9' && s[1] == '\0');
     return true;
diff --git a/js/src/jsapi-tests/testSourcePolicy.cpp b/js/src/jsapi-tests/testSourcePolicy.cpp
index f18ccf2f0ebb..c5a55cfe92c8 100644
--- a/js/src/jsapi-tests/testSourcePolicy.cpp
+++ b/js/src/jsapi-tests/testSourcePolicy.cpp
@@ -3,6 +3,7 @@
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 #include "tests.h"
+#include "jsscript.h"
 
 BEGIN_TEST(testBug795104)
 {
@@ -21,3 +22,26 @@ BEGIN_TEST(testBug795104)
     return true;
 }
 END_TEST(testBug795104)
+
+const char *simpleSource = "var x = 4;";
+
+static void
+newScriptHook(JSContext *cx, const char *fn, unsigned lineno,
+              JSScript *script, JSFunction *fun, void *data)
+{
+    if (!JS_StringEqualsAscii(cx, script->sourceData(cx), simpleSource, (JSBool *)data))
+        *((JSBool *)data) = JS_FALSE;
+}
+
+BEGIN_TEST(testScriptSourceReentrant)
+{
+    JS::CompileOptions opts(cx);
+    JSBool match = false;
+    JS_SetNewScriptHook(rt, newScriptHook, &match);
+    CHECK(JS::Evaluate(cx, global, opts, simpleSource, strlen(simpleSource), NULL));
+    CHECK(match);
+    JS_SetNewScriptHook(rt, NULL, NULL);
+
+    return true;
+}
+END_TEST(testScriptSourceReentrant)
diff --git a/js/src/jsapi.cpp b/js/src/jsapi.cpp
index 0474c4027285..356db90ea5a3 100644
--- a/js/src/jsapi.cpp
+++ b/js/src/jsapi.cpp
@@ -890,7 +890,8 @@ JSRuntime::JSRuntime(JSUseHelperThreads useHelperThreads)
     ctypesActivityCallback(NULL),
     ionReturnOverride_(MagicValue(JS_ARG_POISON)),
     useHelperThreads_(useHelperThreads),
-    requestedHelperThreadCount(-1)
+    requestedHelperThreadCount(-1),
+    rngNonce(0)
 {
     /* Initialize infallibly first, so we can goto bad and JS_DestroyRuntime. */
     JS_INIT_CLIST(&onNewGlobalObjectWatchers);
diff --git a/js/src/jscntxt.cpp b/js/src/jscntxt.cpp
index 01fc9229b492..c300c4ec5fc1 100644
--- a/js/src/jscntxt.cpp
+++ b/js/src/jscntxt.cpp
@@ -265,8 +265,6 @@ js::NewContext(JSRuntime *rt, size_t stackChunkSize)
     bool first = rt->contextList.isEmpty();
     rt->contextList.insertBack(cx);
 
-    js_InitRandom(cx);
-
     /*
      * If cx is the first context on this runtime, initialize well-known atoms,
      * keywords, numbers, strings and self-hosted scripts. If one of these
@@ -1117,7 +1115,6 @@ JSContext::JSContext(JSRuntime *rt)
     outstandingRequests(0),
 #endif
     resolveFlags(0),
-    rngSeed(0),
     iterValue(MagicValue(JS_NO_ITER_VALUE)),
 #ifdef JS_METHODJIT
     methodJitEnabled(false),
diff --git a/js/src/jscntxt.h b/js/src/jscntxt.h
index 47982188b4c4..e78324bf3d8d 100644
--- a/js/src/jscntxt.h
+++ b/js/src/jscntxt.h
@@ -1220,6 +1220,16 @@ struct JSRuntime : js::RuntimeFriendFields
         return 0;
 #endif
     }
+
+  private:
+    /*
+     * Used to ensure that compartments created at the same time get different
+     * random number sequences. See js::InitRandom.
+     */
+    uint64_t rngNonce;
+
+  public:
+    uint64_t nextRNGNonce() { return rngNonce++; }
 };
 
 /* Common macros to access thread-local caches in JSRuntime. */
@@ -1583,9 +1593,6 @@ struct JSContext : js::ContextFriendFields,
     /* Stored here to avoid passing it around as a parameter. */
     unsigned               resolveFlags;
 
-    /* Random number generator state, used by jsmath.cpp. */
-    int64_t             rngSeed;
-
     /* Location to stash the iteration value between JSOP_MOREITER and JSOP_ITERNEXT. */
     js::Value           iterValue;
 
diff --git a/js/src/jscompartment.cpp b/js/src/jscompartment.cpp
index 03c34df2b4dd..756b11463e92 100644
--- a/js/src/jscompartment.cpp
+++ b/js/src/jscompartment.cpp
@@ -80,6 +80,7 @@ JSCompartment::JSCompartment(JSRuntime *rt)
     gcGrayRoots(),
     gcMallocBytes(0),
     debugModeBits(rt->debugMode ? DebugFromC : 0),
+    rngState(0),
     watchpointMap(NULL),
     scriptCountsMap(NULL),
     debugScriptMap(NULL),
@@ -128,6 +129,9 @@ JSCompartment::init(JSContext *cx)
     if (!regExps.init(cx))
         return false;
 
+    if (cx)
+        InitRandom(cx->runtime, &rngState);
+
 #ifdef JSGC_GENERATIONAL
     /*
      * If we are in the middle of post-barrier verification, we need to
diff --git a/js/src/jscompartment.h b/js/src/jscompartment.h
index af7bf427204a..39f75b983e77 100644
--- a/js/src/jscompartment.h
+++ b/js/src/jscompartment.h
@@ -470,6 +470,9 @@ struct JSCompartment : private JS::shadow::Compartment, public js::gc::GraphNode
 
     js::DtoaCache dtoaCache;
 
+    /* Random number generator state, used by jsmath.cpp. */
+    uint64_t rngState;
+
   private:
     /*
      * Weak reference to each global in this compartment that is a debuggee.
diff --git a/js/src/jsdbgapi.cpp b/js/src/jsdbgapi.cpp
index c2efc7735a37..6cd7f8ec9a2a 100644
--- a/js/src/jsdbgapi.cpp
+++ b/js/src/jsdbgapi.cpp
@@ -452,10 +452,11 @@ JS_GetFunctionScript(JSContext *cx, JSFunction *fun)
 {
     if (fun->isNative())
         return NULL;
-    RawScript script;
+    UnrootedScript script;
     if (fun->isInterpretedLazy()) {
-       AutoCompartment funCompartment(cx, fun);
-       script = fun->getOrCreateScript(cx);
+        RootedFunction rootedFun(cx, fun);
+        AutoCompartment funCompartment(cx, rootedFun);
+        script = JSFunction::getOrCreateScript(cx, rootedFun);
         if (!script)
             MOZ_CRASH();
     } else {
diff --git a/js/src/jsfriendapi.cpp b/js/src/jsfriendapi.cpp
index 353c3855a344..f813e2c8288b 100644
--- a/js/src/jsfriendapi.cpp
+++ b/js/src/jsfriendapi.cpp
@@ -990,3 +990,15 @@ js::SetCTypesActivityCallback(JSRuntime *rt, CTypesActivityCallback cb)
 {
     rt->ctypesActivityCallback = cb;
 }
+
+js::AutoCTypesActivityCallback::AutoCTypesActivityCallback(JSContext *cx,
+                                                           js::CTypesActivityType beginType,
+                                                           js::CTypesActivityType endType
+                                                           MOZ_GUARD_OBJECT_NOTIFIER_PARAM_IN_IMPL)
+  : cx(cx), callback(cx->runtime->ctypesActivityCallback), beginType(beginType), endType(endType)
+{
+    MOZ_GUARD_OBJECT_NOTIFIER_INIT;
+
+    if (callback)
+        callback(cx, beginType);
+}
diff --git a/js/src/jsfriendapi.h b/js/src/jsfriendapi.h
index ca19ca53bbe7..122175e184be 100644
--- a/js/src/jsfriendapi.h
+++ b/js/src/jsfriendapi.h
@@ -1083,6 +1083,12 @@ enum ViewType {
      */
     TYPE_UINT8_CLAMPED,
 
+    /*
+     * Type returned for a DataView. Note that there is no single element type
+     * in this case.
+     */
+    TYPE_DATAVIEW,
+
     TYPE_MAX
 };
 
@@ -1256,14 +1262,14 @@ extern JS_FRIEND_API(JSObject *)
 JS_GetObjectAsArrayBuffer(JSObject *obj, uint32_t *length, uint8_t **data);
 
 /*
- * Get the type of elements in a typed array.
+ * Get the type of elements in a typed array, or TYPE_DATAVIEW if a DataView.
  *
- * |obj| must have passed a JS_IsTypedArrayObject/JS_Is*Array test, or somehow
- * be known that it would pass such a test: it is a typed array or a wrapper of
- * a typed array, and the unwrapping will succeed.
+ * |obj| must have passed a JS_IsArrayBufferView/JS_Is*Array test, or somehow
+ * be known that it would pass such a test: it is an ArrayBufferView or a
+ * wrapper of an ArrayBufferView, and the unwrapping will succeed.
  */
 extern JS_FRIEND_API(JSArrayBufferViewType)
-JS_GetTypedArrayType(JSObject *obj);
+JS_GetArrayBufferViewType(JSObject *obj);
 
 /*
  * Check whether obj supports the JS_GetArrayBuffer* APIs. Note that this may
@@ -1563,7 +1569,9 @@ IsTypedArrayThisCheck(JS::IsAcceptableThis test);
 
 enum CTypesActivityType {
     CTYPES_CALL_BEGIN,
-    CTYPES_CALL_END
+    CTYPES_CALL_END,
+    CTYPES_CALLBACK_BEGIN,
+    CTYPES_CALLBACK_END
 };
 
 typedef void
@@ -1576,6 +1584,29 @@ typedef void
 JS_FRIEND_API(void)
 SetCTypesActivityCallback(JSRuntime *rt, CTypesActivityCallback cb);
 
+class JS_FRIEND_API(AutoCTypesActivityCallback) {
+  private:
+    JSContext *cx;
+    CTypesActivityCallback callback;
+    CTypesActivityType beginType;
+    CTypesActivityType endType;
+    MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
+
+  public:
+    AutoCTypesActivityCallback(JSContext *cx, CTypesActivityType beginType,
+                               CTypesActivityType endType
+                               MOZ_GUARD_OBJECT_NOTIFIER_PARAM);
+    ~AutoCTypesActivityCallback() {
+        DoEndCallback();
+    }
+    void DoEndCallback() {
+        if (callback) {
+            callback(cx, endType);
+            callback = NULL;
+        }
+    }
+};
+
 } /* namespace js */
 
 #endif /* jsfriendapi_h___ */
diff --git a/js/src/jsfun.cpp b/js/src/jsfun.cpp
index 2b0b8978cca2..dc101a819a3f 100644
--- a/js/src/jsfun.cpp
+++ b/js/src/jsfun.cpp
@@ -91,7 +91,7 @@ fun_getProperty(JSContext *cx, HandleObject obj_, HandleId id, MutableHandleValu
      * check any calls that were inlined.
      */
     if (fun->isInterpreted()) {
-        fun->getOrCreateScript(cx)->uninlineable = true;
+        JSFunction::getOrCreateScript(cx, fun)->uninlineable = true;
         MarkTypeObjectFlags(cx, fun, OBJECT_FLAG_UNINLINEABLE);
     }
 
@@ -341,7 +341,7 @@ fun_resolve(JSContext *cx, HandleObject obj, HandleId id, unsigned flags,
             PropertyOp getter;
             StrictPropertyOp setter;
             unsigned attrs = JSPROP_PERMANENT;
-            if (fun->isInterpretedLazy() && !fun->getOrCreateScript(cx))
+            if (fun->isInterpretedLazy() && !JSFunction::getOrCreateScript(cx, fun))
                 return false;
             if (fun->isInterpreted() ? fun->strict() : fun->isBoundFunction()) {
                 JSObject *throwTypeError = fun->global().getThrowTypeError();
@@ -1479,7 +1479,7 @@ js_CloneFunctionObject(JSContext *cx, HandleFunction fun, HandleObject parent,
     if (fun->isInterpreted()) {
         if (fun->isInterpretedLazy()) {
             AutoCompartment ac(cx, fun);
-            if (!fun->getOrCreateScript(cx))
+            if (!JSFunction::getOrCreateScript(cx, fun))
                 return NULL;
         }
         clone->initScript(fun->nonLazyScript());
diff --git a/js/src/jsfun.h b/js/src/jsfun.h
index 4310e5e2cc95..3e449dcaa571 100644
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -181,25 +181,26 @@ class JSFunction : public JSObject
     static inline size_t offsetOfEnvironment() { return offsetof(JSFunction, u.i.env_); }
     static inline size_t offsetOfAtom() { return offsetof(JSFunction, atom_); }
 
-    js::UnrootedScript getOrCreateScript(JSContext *cx) {
-        JS_ASSERT(isInterpreted());
-        if (isInterpretedLazy()) {
-            js::RootedFunction self(cx, this);
+    static js::UnrootedScript getOrCreateScript(JSContext *cx, JS::HandleFunction fun) {
+        JS_ASSERT(fun->isInterpreted());
+        if (fun->isInterpretedLazy()) {
             js::MaybeCheckStackRoots(cx);
-            if (!initializeLazyScript(cx))
+            if (!fun->initializeLazyScript(cx))
                 return js::UnrootedScript(NULL);
         }
-        JS_ASSERT(hasScript());
-        return JS::HandleScript::fromMarkedLocation(&u.i.script_);
+        JS_ASSERT(fun->hasScript());
+        return fun->u.i.script_;
     }
 
-    bool maybeGetOrCreateScript(JSContext *cx, js::MutableHandle<JSScript*> script) {
-        if (isNative()) {
+    static bool maybeGetOrCreateScript(JSContext *cx, js::HandleFunction fun,
+                                       js::MutableHandle<JSScript*> script)
+    {
+        if (fun->isNative()) {
             script.set(NULL);
             return true;
         }
-        script.set(getOrCreateScript(cx));
-        return hasScript();
+        script.set(getOrCreateScript(cx, fun));
+        return fun->hasScript();
     }
 
     js::UnrootedScript nonLazyScript() const {
diff --git a/js/src/jsinfer.cpp b/js/src/jsinfer.cpp
index f185a0031e22..9c4a5b50d635 100644
--- a/js/src/jsinfer.cpp
+++ b/js/src/jsinfer.cpp
@@ -1272,7 +1272,7 @@ TypeConstraintCall::newType(JSContext *cx, TypeSet *source, Type type)
         return;
     }
 
-    JSFunction *callee = NULL;
+    RootedFunction callee(cx);
 
     if (type.isSingleObject()) {
         RootedObject obj(cx, type.singleObject());
@@ -1348,7 +1348,7 @@ TypeConstraintCall::newType(JSContext *cx, TypeSet *source, Type type)
         return;
     }
 
-    RootedScript calleeScript(cx, callee->getOrCreateScript(cx));
+    RootedScript calleeScript(cx, JSFunction::getOrCreateScript(cx, callee));
     if (!calleeScript)
         return;
     if (!calleeScript->ensureHasTypes(cx))
@@ -1397,6 +1397,8 @@ TypeConstraintCall::newType(JSContext *cx, TypeSet *source, Type type)
 void
 TypeConstraintPropagateThis::newType(JSContext *cx, TypeSet *source, Type type)
 {
+    AssertCanGC();
+
     if (type.isUnknown() || type.isAnyObject()) {
         /*
          * The callee is unknown, make sure the call is monitored so we pick up
@@ -1410,7 +1412,7 @@ TypeConstraintPropagateThis::newType(JSContext *cx, TypeSet *source, Type type)
     }
 
     /* Ignore calls to natives, these will be handled by TypeConstraintCall. */
-    JSFunction *callee = NULL;
+    RootedFunction callee(cx);
 
     if (type.isSingleObject()) {
         RootedObject object(cx, type.singleObject());
@@ -1427,7 +1429,7 @@ TypeConstraintPropagateThis::newType(JSContext *cx, TypeSet *source, Type type)
         return;
     }
 
-    if (!(callee->getOrCreateScript(cx) && callee->nonLazyScript()->ensureHasTypes(cx)))
+    if (!(JSFunction::getOrCreateScript(cx, callee) && callee->nonLazyScript()->ensureHasTypes(cx)))
         return;
 
     TypeSet *thisTypes = TypeScript::ThisTypes(callee->nonLazyScript());
@@ -3601,9 +3603,11 @@ TypeObject::clearNewScript(JSContext *cx)
 void
 TypeObject::print()
 {
+    TaggedProto tagged(proto);
     printf("%s : %s",
            TypeObjectString(this),
-           proto ? TypeString(Type::ObjectType(proto)) : "(null)");
+           tagged.isObject() ? TypeString(Type::ObjectType(proto))
+                            : (tagged.isLazy() ? "(lazy)" : "(null)"));
 
     if (unknownProperties()) {
         printf(" unknown");
@@ -5751,7 +5755,8 @@ JSObject::makeLazyType(JSContext *cx)
     RootedObject self(cx, this);
     /* De-lazification of functions can GC, so we need to do it up here. */
     if (self->isFunction() && self->toFunction()->isInterpretedLazy()) {
-        if (!self->toFunction()->getOrCreateScript(cx))
+        RootedFunction fun(cx, self->toFunction());
+        if (!JSFunction::getOrCreateScript(cx, fun))
             return NULL;
     }
     JSProtoKey key = JSCLASS_CACHED_PROTO_KEY(getClass());
@@ -5938,6 +5943,18 @@ JSCompartment::getNewType(JSContext *cx, TaggedProto proto_, JSFunction *fun_, b
         if (obj->isXML() && !type->unknownProperties())
             type->flags |= OBJECT_FLAG_UNKNOWN_MASK;
 #endif
+
+        if (obj->isRegExp()) {
+            AddTypeProperty(cx, type, "source", types::Type::StringType());
+            AddTypeProperty(cx, type, "global", types::Type::BooleanType());
+            AddTypeProperty(cx, type, "ignoreCase", types::Type::BooleanType());
+            AddTypeProperty(cx, type, "multiline", types::Type::BooleanType());
+            AddTypeProperty(cx, type, "sticky", types::Type::BooleanType());
+            AddTypeProperty(cx, type, "lastIndex", types::Type::Int32Type());
+        }
+
+        if (obj->isString())
+            AddTypeProperty(cx, type, "length", Type::Int32Type());
     }
 
     /*
diff --git a/js/src/jsinterp.cpp b/js/src/jsinterp.cpp
index 7fe855de6da4..cd8724aa4f9b 100644
--- a/js/src/jsinterp.cpp
+++ b/js/src/jsinterp.cpp
@@ -390,7 +390,7 @@ js::InvokeKernel(JSContext *cx, CallArgs args, MaybeConstruct construct)
     if (fun->isNative())
         return CallJSNative(cx, fun->native(), args);
 
-    RootedScript script(cx, fun->getOrCreateScript(cx));
+    RootedScript script(cx, JSFunction::getOrCreateScript(cx, fun));
     if (!script)
         return false;
 
@@ -2380,7 +2380,7 @@ BEGIN_CASE(JSOP_FUNCALL)
 
     InitialFrameFlags initial = construct ? INITIAL_CONSTRUCT : INITIAL_NONE;
     bool newType = cx->typeInferenceEnabled() && UseNewType(cx, script, regs.pc);
-    RootedScript funScript(cx, fun->getOrCreateScript(cx));
+    RootedScript funScript(cx, JSFunction::getOrCreateScript(cx, fun));
     if (!funScript)
         goto error;
     if (!cx->stack.pushInlineFrame(cx, regs, args, *fun, funScript, initial))
diff --git a/js/src/jsiter.cpp b/js/src/jsiter.cpp
index 4d9490174d80..06266056db3b 100644
--- a/js/src/jsiter.cpp
+++ b/js/src/jsiter.cpp
@@ -743,7 +743,7 @@ js_ThrowStopIteration(JSContext *cx)
     RootedValue v(cx);
     if (js_FindClassObject(cx, JSProto_StopIteration, &v))
         cx->setPendingException(v);
-    return JS_FALSE;
+    return false;
 }
 
 /*** Iterator objects ****************************************************************************/
@@ -1038,7 +1038,7 @@ js::CloseIterator(JSContext *cx, HandleObject obj)
         return CloseGenerator(cx, obj);
     }
 #endif
-    return JS_TRUE;
+    return true;
 }
 
 bool
@@ -1298,7 +1298,7 @@ static JSBool
 stopiter_hasInstance(JSContext *cx, HandleObject obj, MutableHandleValue v, JSBool *bp)
 {
     *bp = IsStopIteration(v);
-    return JS_TRUE;
+    return true;
 }
 
 Class js::StopIterationClass = {
@@ -1511,7 +1511,7 @@ SendToGenerator(JSContext *cx, JSGeneratorOp op, HandleObject obj,
 
     if (gen->state == JSGEN_RUNNING || gen->state == JSGEN_CLOSING) {
         JS_ReportErrorNumber(cx, js_GetErrorMessage, NULL, JSMSG_NESTING_GENERATOR);
-        return JS_FALSE;
+        return false;
     }
 
     /*
@@ -1559,7 +1559,7 @@ SendToGenerator(JSContext *cx, JSGeneratorOp op, HandleObject obj,
         GeneratorFrameGuard gfg;
         if (!cx->stack.pushGeneratorFrame(cx, gen, &gfg)) {
             SetGeneratorClosed(cx, gen);
-            return JS_FALSE;
+            return false;
         }
 
         /*
@@ -1584,14 +1584,15 @@ SendToGenerator(JSContext *cx, JSGeneratorOp op, HandleObject obj,
     }
 
     if (gen->fp->isYielding()) {
-        /* Yield cannot fail, throw or be called on closing. */
-        JS_ASSERT(ok);
-        JS_ASSERT(!cx->isExceptionPending());
+        /*
+         * Yield is ordinarily infallible, but ok can be false here if a
+         * Debugger.Frame.onPop hook fails.
+         */
         JS_ASSERT(gen->state == JSGEN_RUNNING);
         JS_ASSERT(op != JSGENOP_CLOSE);
         gen->fp->clearYielding();
         gen->state = JSGEN_OPEN;
-        return JS_TRUE;
+        return ok;
     }
 
     gen->fp->clearReturnValue();
@@ -1599,7 +1600,7 @@ SendToGenerator(JSContext *cx, JSGeneratorOp op, HandleObject obj,
     if (ok) {
         /* Returned, explicitly or by falling off the end. */
         if (op == JSGENOP_CLOSE)
-            return JS_TRUE;
+            return true;
         return js_ThrowStopIteration(cx);
     }
 
@@ -1607,7 +1608,7 @@ SendToGenerator(JSContext *cx, JSGeneratorOp op, HandleObject obj,
      * An error, silent termination by operation callback or an exception.
      * Propagate the condition to the caller.
      */
-    return JS_FALSE;
+    return false;
 }
 
 static JSBool
@@ -1618,11 +1619,11 @@ CloseGenerator(JSContext *cx, HandleObject obj)
     JSGenerator *gen = (JSGenerator *) obj->getPrivate();
     if (!gen) {
         /* Generator prototype object. */
-        return JS_TRUE;
+        return true;
     }
 
     if (gen->state == JSGEN_CLOSED)
-        return JS_TRUE;
+        return true;
 
     return SendToGenerator(cx, JSGENOP_CLOSE, obj, gen, UndefinedValue());
 }
diff --git a/js/src/jsmath.cpp b/js/src/jsmath.cpp
index d1faaeb627a3..5cf1b54a6834 100644
--- a/js/src/jsmath.cpp
+++ b/js/src/jsmath.cpp
@@ -517,47 +517,48 @@ js_math_pow(JSContext *cx, unsigned argc, Value *vp)
 # pragma optimize("", on)
 #endif
 
-static const int64_t RNG_MULTIPLIER = 0x5DEECE66DLL;
-static const int64_t RNG_ADDEND = 0xBLL;
-static const int64_t RNG_MASK = (1LL << 48) - 1;
+static const uint64_t RNG_MULTIPLIER = 0x5DEECE66DLL;
+static const uint64_t RNG_ADDEND = 0xBLL;
+static const uint64_t RNG_MASK = (1LL << 48) - 1;
 static const double RNG_DSCALE = double(1LL << 53);
 
 /*
  * Math.random() support, lifted from java.util.Random.java.
  */
 extern void
-random_setSeed(int64_t *rngSeed, int64_t seed)
+random_setSeed(uint64_t *rngState, uint64_t seed)
 {
-    *rngSeed = (seed ^ RNG_MULTIPLIER) & RNG_MASK;
+    *rngState = (seed ^ RNG_MULTIPLIER) & RNG_MASK;
 }
 
 void
-js_InitRandom(JSContext *cx)
+js::InitRandom(JSRuntime *rt, uint64_t *rngState)
 {
     /*
-     * Set the seed from current time. Since we have a RNG per context and we often bring
-     * up several contexts at the same time, we xor in some additional values, namely
-     * the context and its successor. We don't just use the context because it might be
-     * possible to reverse engineer the context pointer if one guesses the time right.
+     * Set the seed from current time. Since we have a RNG per compartment and
+     * we often bring up several compartments at the same time, mix in a
+     * different integer each time. This is only meant to prevent all the new
+     * compartments from getting the same sequence of pseudo-random
+     * numbers. There's no security guarantee.
      */
-    random_setSeed(&cx->rngSeed, (PRMJ_Now() / 1000) ^ int64_t(cx) ^ int64_t(cx->getNext()));
+    random_setSeed(rngState, (uint64_t(PRMJ_Now()) << 8) ^ rt->nextRNGNonce());
 }
 
 extern uint64_t
-random_next(int64_t *rngSeed, int bits)
+random_next(uint64_t *rngState, int bits)
 {
-    uint64_t nextseed = *rngSeed * RNG_MULTIPLIER;
-    nextseed += RNG_ADDEND;
-    nextseed &= RNG_MASK;
-    *rngSeed = nextseed;
-    return nextseed >> (48 - bits);
+    uint64_t nextstate = *rngState * RNG_MULTIPLIER;
+    nextstate += RNG_ADDEND;
+    nextstate &= RNG_MASK;
+    *rngState = nextstate;
+    return nextstate >> (48 - bits);
 }
 
 static inline double
 random_nextDouble(JSContext *cx)
 {
-    return double((random_next(&cx->rngSeed, 26) << 27) + random_next(&cx->rngSeed, 27)) /
-           RNG_DSCALE;
+    uint64_t *rng = &cx->compartment->rngState;
+    return double((random_next(rng, 26) << 27) + random_next(rng, 27)) / RNG_DSCALE;
 }
 
 double
diff --git a/js/src/jsmath.h b/js/src/jsmath.h
index 832c83a1c1d2..29900f3e6bde 100644
--- a/js/src/jsmath.h
+++ b/js/src/jsmath.h
@@ -45,6 +45,9 @@ class MathCache
     size_t sizeOfIncludingThis(JSMallocSizeOfFun mallocSizeOf);
 };
 
+extern void
+InitRandom(JSRuntime *rt, uint64_t *rngState);
+
 } /* namespace js */
 
 /*
@@ -54,9 +57,6 @@ class MathCache
 extern JSObject *
 js_InitMathClass(JSContext *cx, js::HandleObject obj);
 
-extern void
-js_InitRandom(JSContext *cx);
-
 extern double
 math_random_no_outparam(JSContext *cx);
 
diff --git a/js/src/jsscript.cpp b/js/src/jsscript.cpp
index 39d979c06d40..654117651c97 100644
--- a/js/src/jsscript.cpp
+++ b/js/src/jsscript.cpp
@@ -945,6 +945,13 @@ SourceCompressorThread::finish()
         PR_DestroyLock(lock);
 }
 
+const jschar *
+SourceCompressorThread::currentChars() const
+{
+    JS_ASSERT(tok);
+    return tok->chars;
+}
+
 bool
 SourceCompressorThread::internalCompress()
 {
@@ -1051,6 +1058,7 @@ SourceCompressorThread::compress(SourceCompressionToken *sct)
     JS_ASSERT(!tok);
     stop = false;
     PR_Lock(lock);
+    sct->ss->ready_ = false;
     tok = sct;
     state = COMPRESSING;
     PR_NotifyCondVar(wakeup);
@@ -1070,9 +1078,7 @@ SourceCompressorThread::waitOnCompression(SourceCompressionToken *userTok)
     PR_Unlock(lock);
 
     JS_ASSERT(!saveTok->ss->ready());
-#ifdef DEBUG
     saveTok->ss->ready_ = true;
-#endif
 
     // Update memory accounting.
     if (!saveTok->oom)
@@ -1183,10 +1189,14 @@ SourceDataCache::purge()
 JSFlatString *
 ScriptSource::substring(JSContext *cx, uint32_t start, uint32_t stop)
 {
-    JS_ASSERT(ready());
     const jschar *chars;
 #if USE_ZLIB
     Rooted<JSStableString *> cached(cx, NULL);
+#ifdef JS_THREADSAFE
+    if (!ready()) {
+        chars = cx->runtime->sourceCompressorThread.currentChars();
+    } else
+#endif
     if (compressed()) {
         cached = cx->runtime->sourceDataCache.lookup(this);
         if (!cached) {
@@ -1229,9 +1239,6 @@ ScriptSource::setSourceCopy(JSContext *cx, StableCharPtr src, uint32_t length,
 
 #ifdef JS_THREADSAFE
     if (tok && cx->runtime->useHelperThreads()) {
-#ifdef DEBUG
-        ready_ = false;
-#endif
         tok->ss = this;
         tok->chars = src.get();
         cx->runtime->sourceCompressorThread.compress(tok);
@@ -1287,9 +1294,7 @@ ScriptSource::destroy(JSRuntime *rt)
     JS_ASSERT(ready());
     adjustDataSize(0);
     js_free(sourceMap_);
-#ifdef DEBUG
     ready_ = false;
-#endif
     js_free(this);
 }
 
@@ -1373,10 +1378,8 @@ ScriptSource::performXDR(XDRState<mode> *xdr)
         sourceMap_[sourceMapLen] = '\0';
     }
 
-#ifdef DEBUG
     if (mode == XDR_DECODE)
         ready_ = true;
-#endif
 
     return true;
 }
diff --git a/js/src/jsscript.h b/js/src/jsscript.h
index 80a7e5a72298..011eabbfd864 100644
--- a/js/src/jsscript.h
+++ b/js/src/jsscript.h
@@ -1036,9 +1036,7 @@ struct ScriptSource
     // possible to get source at all.
     bool sourceRetrievable_:1;
     bool argumentsNotIncluded_:1;
-#ifdef DEBUG
     bool ready_:1;
-#endif
 
   public:
     ScriptSource()
@@ -1047,10 +1045,8 @@ struct ScriptSource
         compressedLength_(0),
         sourceMap_(NULL),
         sourceRetrievable_(false),
-        argumentsNotIncluded_(false)
-#ifdef DEBUG
-       ,ready_(true)
-#endif
+        argumentsNotIncluded_(false),
+        ready_(true)
     {
         data.source = NULL;
     }
@@ -1066,12 +1062,10 @@ struct ScriptSource
                        bool argumentsNotIncluded,
                        SourceCompressionToken *tok);
     void setSource(const jschar *src, uint32_t length);
-#ifdef DEBUG
     bool ready() const { return ready_; }
-#endif
     void setSourceRetrievable() { sourceRetrievable_ = true; }
     bool sourceRetrievable() const { return sourceRetrievable_; }
-    bool hasSourceData() const { return !!data.source; }
+    bool hasSourceData() const { return !!data.source || !ready(); }
     uint32_t length() const {
         JS_ASSERT(hasSourceData());
         return length_;
@@ -1173,6 +1167,7 @@ class SourceCompressorThread
     void compress(SourceCompressionToken *tok);
     void waitOnCompression(SourceCompressionToken *userTok);
     void abort(SourceCompressionToken *userTok);
+    const jschar *currentChars() const;
 };
 #endif
 
diff --git a/js/src/jsstr.cpp b/js/src/jsstr.cpp
index 4aa5e3659c32..1e7ce6f3b2ed 100644
--- a/js/src/jsstr.cpp
+++ b/js/src/jsstr.cpp
@@ -1132,107 +1132,110 @@ RopeMatch(JSContext *cx, JSString *textstr, const jschar *pat, uint32_t patlen,
     return true;
 }
 
-/* ES6 20120708 draft 15.5.4.24. */
+/* ES6 20121026 draft 15.5.4.24. */
 static JSBool
 str_contains(JSContext *cx, unsigned argc, Value *vp)
 {
+    AssertCanGC();
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    // Steps 1 and 2
+    // Steps 1, 2, and 3
     RootedString str(cx, ThisToStringForStringProto(cx, args));
     if (!str)
         return false;
 
-    // Step 3
-    Rooted<JSLinearString *> patstr(cx, ArgToRootedString(cx, args, 0));
-    if (!patstr)
+    // Steps 4 and 5
+    Rooted<JSLinearString*> searchStr(cx, ArgToRootedString(cx, args, 0));
+    if (!searchStr)
         return false;
 
-    // Step 5
-    uint32_t textlen = str->length();
-    const jschar *text = str->getChars(cx);
-    if (!text)
-        return false;
-
-    // XXX fix for moving GC.
-    SkipRoot skip(cx, &text);
-
+    // Steps 6 and 7
+    uint32_t pos = 0;
     if (args.hasDefined(1)) {
-        // Step 4
-        double posDouble;
-        if (!ToInteger(cx, args[1], &posDouble))
-            return false;
-
-        // Step 6
-        uint32_t delta = uint32_t(Min(double(textlen), Max(0.0, posDouble)));
-        text += delta;
-        textlen -= delta;
-    }
-
-    // Step 7
-    uint32_t patlen = patstr->length();
-    const jschar *pat = patstr->chars();
-
-    // Step 8
-    args.rval().setBoolean(StringMatch(text, textlen, pat, patlen) >= 0);
-    return true;
-}
-
-static JSBool
-str_indexOf(JSContext *cx, unsigned argc, Value *vp)
-{
-    CallArgs args = CallArgsFromVp(argc, vp);
-    RootedString str(cx, ThisToStringForStringProto(cx, args));
-    if (!str)
-        return false;
-
-    JSLinearString *patstr = ArgToRootedString(cx, args, 0);
-    if (!patstr)
-        return false;
-
-    uint32_t textlen = str->length();
-    const jschar *text = str->getChars(cx);
-    if (!text)
-        return false;
-
-    uint32_t patlen = patstr->length();
-    const jschar *pat = patstr->chars();
-    SkipRoot skipPat(cx, &pat);
-
-    uint32_t start;
-    if (args.length() > 1) {
         if (args[1].isInt32()) {
             int i = args[1].toInt32();
-            if (i <= 0) {
-                start = 0;
-            } else if (uint32_t(i) > textlen) {
-                start = textlen;
-                textlen = 0;
-            } else {
-                start = i;
-                text += start;
-                textlen -= start;
-            }
+            pos = (i < 0) ? 0U : uint32_t(i);
         } else {
             double d;
             if (!ToInteger(cx, args[1], &d))
                 return false;
-            if (d <= 0) {
-                start = 0;
-            } else if (d > textlen) {
-                start = textlen;
-                textlen = 0;
-            } else {
-                start = (int)d;
-                text += start;
-                textlen -= start;
-            }
+            pos = uint32_t(Min(Max(d, 0.0), double(UINT32_MAX)));
         }
-    } else {
-        start = 0;
     }
 
-    int match = StringMatch(text, textlen, pat, patlen);
+    AutoAssertNoGC nogc;
+
+    // Step 8
+    uint32_t textLen = str->length();
+    const jschar *textChars = str->getChars(cx);
+    if (!textChars)
+        return false;
+
+    // Step 9
+    uint32_t start = Min(Max(pos, 0U), textLen);
+
+    // Step 10
+    uint32_t searchLen = searchStr->length();
+    const jschar *searchChars = searchStr->chars();
+
+    // Step 11
+    textChars += start;
+    textLen -= start;
+    int match = StringMatch(textChars, textLen, searchChars, searchLen);
+    args.rval().setBoolean(match != -1);
+    return true;
+}
+
+/* ES6 20120927 draft 15.5.4.7. */
+static JSBool
+str_indexOf(JSContext *cx, unsigned argc, Value *vp)
+{
+    AssertCanGC();
+    CallArgs args = CallArgsFromVp(argc, vp);
+
+    // Steps 1, 2, and 3
+    RootedString str(cx, ThisToStringForStringProto(cx, args));
+    if (!str)
+        return false;
+
+    // Steps 4 and 5
+    Rooted<JSLinearString*> searchStr(cx, ArgToRootedString(cx, args, 0));
+    if (!searchStr)
+        return false;
+
+    // Steps 6 and 7
+    uint32_t pos = 0;
+    if (args.hasDefined(1)) {
+        if (args[1].isInt32()) {
+            int i = args[1].toInt32();
+            pos = (i < 0) ? 0U : uint32_t(i);
+        } else {
+            double d;
+            if (!ToInteger(cx, args[1], &d))
+                return false;
+            pos = uint32_t(Min(Max(d, 0.0), double(UINT32_MAX)));
+        }
+    }
+
+    AutoAssertNoGC nogc;
+
+    // Step 8
+    uint32_t textLen = str->length();
+    const jschar *textChars = str->getChars(cx);
+    if (!textChars)
+        return false;
+
+    // Step 9
+    uint32_t start = Min(Max(pos, 0U), textLen);
+
+    // Step 10
+    uint32_t searchLen = searchStr->length();
+    const jschar *searchChars = searchStr->chars();
+
+    // Step 11
+    textChars += start;
+    textLen -= start;
+    int match = StringMatch(textChars, textLen, searchChars, searchLen);
     args.rval().setInt32((match == -1) ? -1 : start + match);
     return true;
 }
@@ -1314,49 +1317,60 @@ str_lastIndexOf(JSContext *cx, unsigned argc, Value *vp)
     return true;
 }
 
-/* ES6 20120708 draft 15.5.4.22. */
+/* ES6 20120927 draft 15.5.4.22. */
 static JSBool
 str_startsWith(JSContext *cx, unsigned argc, Value *vp)
 {
+    AssertCanGC();
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    // Steps 1 and 2
+    // Steps 1, 2, and 3
     RootedString str(cx, ThisToStringForStringProto(cx, args));
     if (!str)
         return false;
 
-    // Step 3
-    Rooted<JSLinearString *> patstr(cx, ArgToRootedString(cx, args, 0));
-    if (!patstr)
+    // Steps 4 and 5
+    Rooted<JSLinearString*> searchStr(cx, ArgToRootedString(cx, args, 0));
+    if (!searchStr)
         return false;
 
-    // Step 5
-    uint32_t textlen = str->length();
-    const jschar *text = str->getChars(cx);
-    if (!text)
-        return false;
-
-    // XXX fix for moving GC.
-    SkipRoot skip(cx, &text);
-
+    // Steps 6 and 7
+    uint32_t pos = 0;
     if (args.hasDefined(1)) {
-        // Step 4
-        double posDouble;
-        if (!ToInteger(cx, args[1], &posDouble))
-            return false;
-
-        // Step 6
-        uint32_t position = Min(double(textlen), Max(0.0, posDouble));
-        text += position;
-        textlen -= position;
+        if (args[1].isInt32()) {
+            int i = args[1].toInt32();
+            pos = (i < 0) ? 0U : uint32_t(i);
+        } else {
+            double d;
+            if (!ToInteger(cx, args[1], &d))
+                return false;
+            pos = uint32_t(Min(Max(d, 0.0), double(UINT32_MAX)));
+        }
     }
 
-    // Step 7
-    uint32_t patlen = patstr->length();
-    const jschar *pat = patstr->chars();
+    AutoAssertNoGC nogc;
 
-    // Steps 8, 9, and 10.
-    args.rval().setBoolean(textlen >= patlen && PodEqual(text, pat, patlen));
+    // Step 8
+    uint32_t textLen = str->length();
+    const jschar *textChars = str->getChars(cx);
+    if (!textChars)
+        return false;
+
+    // Step 9
+    uint32_t start = Min(Max(pos, 0U), textLen);
+
+    // Step 10
+    uint32_t searchLen = searchStr->length();
+    const jschar *searchChars = searchStr->chars();
+
+    // Step 11
+    if (searchLen + start < searchLen || searchLen + start > textLen) {
+        args.rval().setBoolean(false);
+        return true;
+    }
+
+    // Steps 12 and 13
+    args.rval().setBoolean(PodEqual(textChars + start, searchChars, searchLen));
     return true;
 }
 
@@ -1364,43 +1378,61 @@ str_startsWith(JSContext *cx, unsigned argc, Value *vp)
 static JSBool
 str_endsWith(JSContext *cx, unsigned argc, Value *vp)
 {
+    AssertCanGC();
     CallArgs args = CallArgsFromVp(argc, vp);
 
-    // Steps 1 and 2
+    // Steps 1, 2, and 3
     RootedString str(cx, ThisToStringForStringProto(cx, args));
     if (!str)
         return false;
 
-    // Step 3
-    Rooted<JSLinearString *> patstr(cx, ArgToRootedString(cx, args, 0));
-    if (!patstr)
+    // Steps 4 and 5
+    Rooted<JSLinearString *> searchStr(cx, ArgToRootedString(cx, args, 0));
+    if (!searchStr)
         return false;
 
-    // Step 4
-    uint32_t textlen = str->length();
-    const jschar *text = str->getChars(cx);
-    if (!text)
-        return false;
-
-    // XXX fix for moving GC.
-    SkipRoot skip(cx, &text);
+    // Step 6
+    uint32_t textLen = str->length();
 
+    // Steps 7 and 8
+    uint32_t pos = textLen;
     if (args.hasDefined(1)) {
-        // Step 5
-        double endPosDouble;
-        if (!ToInteger(cx, args[1], &endPosDouble))
-            return false;
-
-        // Step 6
-        textlen = Min(double(textlen), Max(0.0, endPosDouble));
+        if (args[1].isInt32()) {
+            int i = args[1].toInt32();
+            pos = (i < 0) ? 0U : uint32_t(i);
+        } else {
+            double d;
+            if (!ToInteger(cx, args[1], &d))
+                return false;
+            pos = uint32_t(Min(Max(d, 0.0), double(UINT32_MAX)));
+        }
     }
 
-    // Step 7
-    uint32_t patlen = patstr->length();
-    const jschar *pat = patstr->chars();
+    AutoAssertNoGC nogc;
 
-    // Steps 8-11
-    args.rval().setBoolean(textlen >= patlen && PodEqual(text + textlen - patlen, pat, patlen));
+    // Step 6
+    const jschar *textChars = str->getChars(cx);
+    if (!textChars)
+        return false;
+
+    // Step 9
+    uint32_t end = Min(Max(pos, 0U), textLen);
+
+    // Step 10
+    uint32_t searchLen = searchStr->length();
+    const jschar *searchChars = searchStr->chars();
+
+    // Step 12
+    if (searchLen > end) {
+        args.rval().setBoolean(false);
+        return true;
+    }
+
+    // Step 11
+    uint32_t start = end - searchLen;
+
+    // Steps 13 and 14
+    args.rval().setBoolean(PodEqual(textChars + start, searchChars, searchLen));
     return true;
 }
 
@@ -1548,7 +1580,9 @@ class StringRegExpGuard
     }
 
   public:
-    StringRegExpGuard(JSContext *cx) : fm(cx) {}
+    StringRegExpGuard(JSContext *cx)
+      : re_(cx), fm(cx)
+    { }
 
     /* init must succeed in order to call tryFlatMatch or normalizeRegExp. */
     bool init(JSContext *cx, CallArgs args, bool convertVoid = false)
@@ -1632,7 +1666,7 @@ class StringRegExpGuard
             opt = NULL;
         }
 
-        JSAtom *patstr;
+        Rooted<JSAtom *> patstr(cx);
         if (flat) {
             patstr = flattenPattern(cx, fm.patstr);
             if (!patstr)
@@ -2784,7 +2818,7 @@ js::str_split(JSContext *cx, unsigned argc, Value *vp)
     }
 
     /* Step 8. */
-    RegExpGuard re;
+    RegExpGuard re(cx);
     JSLinearString *sepstr = NULL;
     bool sepDefined = args.hasDefined(0);
     if (sepDefined) {
@@ -3312,12 +3346,6 @@ js_InitStringClass(JSContext *cx, HandleObject obj)
         return NULL;
     }
 
-    /* Capture normal data properties pregenerated for String objects. */
-    TypeObject *type = proto->getNewType(cx);
-    if (!type)
-        return NULL;
-    AddTypeProperty(cx, type, "length", Type::Int32Type());
-
     if (!DefineConstructorAndPrototype(cx, global, JSProto_String, ctor, proto))
         return NULL;
 
diff --git a/js/src/jstypedarray.cpp b/js/src/jstypedarray.cpp
index 9c77e937c4aa..96acb1e88512 100644
--- a/js/src/jstypedarray.cpp
+++ b/js/src/jstypedarray.cpp
@@ -3771,13 +3771,18 @@ JS_GetTypedArrayByteLength(JSObject *obj)
 }
 
 JS_FRIEND_API(JSArrayBufferViewType)
-JS_GetTypedArrayType(JSObject *obj)
+JS_GetArrayBufferViewType(JSObject *obj)
 {
     obj = UnwrapObjectChecked(obj);
     if (!obj)
         return ArrayBufferView::TYPE_MAX;
-    JS_ASSERT(obj->isTypedArray());
-    return static_cast<JSArrayBufferViewType>(TypedArray::type(obj));
+
+    if (obj->isTypedArray())
+        return static_cast<JSArrayBufferViewType>(TypedArray::type(obj));
+    else if (obj->isDataView())
+        return ArrayBufferView::TYPE_DATAVIEW;
+    JS_NOT_REACHED("invalid ArrayBufferView type");
+    return ArrayBufferView::TYPE_MAX;
 }
 
 JS_FRIEND_API(int8_t *)
diff --git a/js/src/jsutil.h b/js/src/jsutil.h
index 7285de08f6fe..3cbd306cb84f 100644
--- a/js/src/jsutil.h
+++ b/js/src/jsutil.h
@@ -257,15 +257,6 @@ PodEqual(T *one, T *two, size_t len)
     return !memcmp(one, two, len * sizeof(T));
 }
 
-template <class T>
-JS_ALWAYS_INLINE static void
-Swap(T &t, T &u)
-{
-    T tmp(Move(t));
-    t = Move(u);
-    u = Move(tmp);
-}
-
 template <typename T>
 static inline bool
 IsPowerOfTwo(T t)
diff --git a/js/src/jswatchpoint.cpp b/js/src/jswatchpoint.cpp
index 58f6c5f466b4..3f9dc5d1b56b 100644
--- a/js/src/jswatchpoint.cpp
+++ b/js/src/jswatchpoint.cpp
@@ -93,8 +93,12 @@ WatchpointMap::unwatch(JSObject *obj, jsid id,
     if (Map::Ptr p = map.lookup(WatchKey(obj, id))) {
         if (handlerp)
             *handlerp = p->value.handler;
-        if (closurep)
+        if (closurep) {
+            // Read barrier to prevent an incorrectly gray closure from escaping the
+            // watchpoint. See the comment before UnmarkGrayChildren in gc/Marking.cpp
+            ExposeGCThingToActiveJS(p->value.closure, JSTRACE_OBJECT);
             *closurep = p->value.closure;
+        }
         map.remove(p);
     }
 }
@@ -138,6 +142,10 @@ WatchpointMap::triggerWatchpoint(JSContext *cx, HandleObject obj, HandleId id, M
         }
     }
 
+    // Read barrier to prevent an incorrectly gray closure from escaping the
+    // watchpoint. See the comment before UnmarkGrayChildren in gc/Marking.cpp
+    ExposeGCThingToActiveJS(closure, JSTRACE_OBJECT);
+
     /* Call the handler. */
     return handler(cx, obj, id, old, vp.address(), closure);
 }
diff --git a/js/src/jsweakmap.cpp b/js/src/jsweakmap.cpp
index 7da3a45fd4e0..2b1b50f255b0 100644
--- a/js/src/jsweakmap.cpp
+++ b/js/src/jsweakmap.cpp
@@ -209,6 +209,10 @@ WeakMap_get_impl(JSContext *cx, CallArgs args)
 
     if (ObjectValueMap *map = GetObjectMap(&args.thisv().toObject())) {
         if (ObjectValueMap::Ptr ptr = map->lookup(key)) {
+            // Read barrier to prevent an incorrectly gray value from escaping the
+            // weak map. See the comment before UnmarkGrayChildren in gc/Marking.cpp
+            ExposeValueToActiveJS(ptr->value.get());
+
             args.rval().set(ptr->value);
             return true;
         }
diff --git a/js/src/jsworkers.cpp b/js/src/jsworkers.cpp
index cf2cca5bd4e9..6acfd84fd4d3 100644
--- a/js/src/jsworkers.cpp
+++ b/js/src/jsworkers.cpp
@@ -19,12 +19,6 @@ using mozilla::DebugOnly;
 
 #ifdef JS_PARALLEL_COMPILATION
 
-bool
-js::OffThreadCompilationAvailable(JSContext *cx)
-{
-    return cx->runtime->useHelperThreads() && cx->runtime->helperThreadCount() > 0;
-}
-
 bool
 js::StartOffThreadIonCompile(JSContext *cx, ion::IonBuilder *builder)
 {
@@ -360,10 +354,4 @@ js::CancelOffThreadIonCompile(JSCompartment *compartment, JSScript *script)
 {
 }
 
-bool
-js::OffThreadCompilationAvailable(JSContext *cx)
-{
-    return false;
-}
-
 #endif /* JS_PARALLEL_COMPILATION */
diff --git a/js/src/jsworkers.h b/js/src/jsworkers.h
index 1b4c8237511c..04f76b083595 100644
--- a/js/src/jsworkers.h
+++ b/js/src/jsworkers.h
@@ -120,10 +120,6 @@ StartOffThreadIonCompile(JSContext *cx, ion::IonBuilder *builder);
 void
 CancelOffThreadIonCompile(JSCompartment *compartment, JSScript *script);
 
-/* Return true iff off-thread compilation is possible. */
-bool
-OffThreadCompilationAvailable(JSContext *cx);
-
 class AutoLockWorkerThreadState
 {
     JSRuntime *rt;
diff --git a/js/src/methodjit/Compiler.cpp b/js/src/methodjit/Compiler.cpp
index 10dabcd4837d..ebdc247a8db4 100644
--- a/js/src/methodjit/Compiler.cpp
+++ b/js/src/methodjit/Compiler.cpp
@@ -2284,6 +2284,9 @@ mjit::Compiler::generateMethod()
         if (script_->hasScriptCounts && JOF_OPTYPE(op) == JOF_JUMP)
             updatePCCounts(PC, &countsUpdated);
 
+        /* Use a common root to avoid frequent re-rooting. */
+        RootedPropertyName name0(cx);
+
     /**********************
      * BEGIN COMPILER OPS *
      **********************/
@@ -2629,10 +2632,10 @@ mjit::Compiler::generateMethod()
           BEGIN_CASE(JSOP_DELNAME)
           {
             uint32_t index = GET_UINT32_INDEX(PC);
-            PropertyName *name = script_->getName(index);
+            name0 = script_->getName(index);
 
             prepareStubCall(Uses(0));
-            masm.move(ImmPtr(name), Registers::ArgReg1);
+            masm.move(ImmPtr(name0), Registers::ArgReg1);
             INLINE_STUBCALL(stubs::DelName, REJOIN_FALLTHROUGH);
             pushSyncedEntry(0);
           }
@@ -2641,10 +2644,10 @@ mjit::Compiler::generateMethod()
           BEGIN_CASE(JSOP_DELPROP)
           {
             uint32_t index = GET_UINT32_INDEX(PC);
-            PropertyName *name = script_->getName(index);
+            name0 = script_->getName(index);
 
             prepareStubCall(Uses(1));
-            masm.move(ImmPtr(name), Registers::ArgReg1);
+            masm.move(ImmPtr(name0), Registers::ArgReg1);
             INLINE_STUBCALL(STRICT_VARIANT(script_, stubs::DelProp), REJOIN_FALLTHROUGH);
             frame.pop();
             pushSyncedEntry(0);
@@ -2673,7 +2676,8 @@ mjit::Compiler::generateMethod()
           BEGIN_CASE(JSOP_GETPROP)
           BEGIN_CASE(JSOP_CALLPROP)
           BEGIN_CASE(JSOP_LENGTH)
-            if (!jsop_getprop(script_->getName(GET_UINT32_INDEX(PC)), knownPushedType(0)))
+            name0 = script_->getName(GET_UINT32_INDEX(PC));
+            if (!jsop_getprop(name0, knownPushedType(0)))
                 return Compile_Error;
           END_CASE(JSOP_GETPROP)
 
@@ -2750,19 +2754,19 @@ mjit::Compiler::generateMethod()
           BEGIN_CASE(JSOP_NAME)
           BEGIN_CASE(JSOP_CALLNAME)
           {
-            PropertyName *name = script_->getName(GET_UINT32_INDEX(PC));
-            jsop_name(name, knownPushedType(0));
-            frame.extra(frame.peek(-1)).name = name;
+            name0 = script_->getName(GET_UINT32_INDEX(PC));
+            jsop_name(name0, knownPushedType(0));
+            frame.extra(frame.peek(-1)).name = name0;
           }
           END_CASE(JSOP_NAME)
 
           BEGIN_CASE(JSOP_GETINTRINSIC)
           BEGIN_CASE(JSOP_CALLINTRINSIC)
           {
-            PropertyName *name = script_->getName(GET_UINT32_INDEX(PC));
-            if (!jsop_intrinsic(name, knownPushedType(0)))
+            name0 = script_->getName(GET_UINT32_INDEX(PC));
+            if (!jsop_intrinsic(name0, knownPushedType(0)))
                 return Compile_Error;
-            frame.extra(frame.peek(-1)).name = name;
+            frame.extra(frame.peek(-1)).name = name0;
           }
           END_CASE(JSOP_GETINTRINSIC)
 
@@ -3025,14 +3029,16 @@ mjit::Compiler::generateMethod()
           END_CASE(JSOP_INITELEM)
 
           BEGIN_CASE(JSOP_BINDNAME)
-            jsop_bindname(script_->getName(GET_UINT32_INDEX(PC)));
+            name0 = script_->getName(GET_UINT32_INDEX(PC));
+            jsop_bindname(name0);
           END_CASE(JSOP_BINDNAME)
 
           BEGIN_CASE(JSOP_SETPROP)
           {
             jsbytecode *next = &PC[JSOP_SETPROP_LENGTH];
             bool pop = JSOp(*next) == JSOP_POP && !analysis->jumpTarget(next);
-            if (!jsop_setprop(script_->getName(GET_UINT32_INDEX(PC)), pop))
+            name0 = script_->getName(GET_UINT32_INDEX(PC));
+            if (!jsop_setprop(name0, pop))
                 return Compile_Error;
           }
           END_CASE(JSOP_SETPROP)
@@ -3041,7 +3047,8 @@ mjit::Compiler::generateMethod()
           {
             jsbytecode *next = &PC[JSOP_SETNAME_LENGTH];
             bool pop = JSOp(*next) == JSOP_POP && !analysis->jumpTarget(next);
-            if (!jsop_setprop(script_->getName(GET_UINT32_INDEX(PC)), pop))
+            name0 = script_->getName(GET_UINT32_INDEX(PC));
+            if (!jsop_setprop(name0, pop))
                 return Compile_Error;
           }
           END_CASE(JSOP_SETNAME)
@@ -3119,20 +3126,20 @@ mjit::Compiler::generateMethod()
           BEGIN_CASE(JSOP_DEFVAR)
           BEGIN_CASE(JSOP_DEFCONST)
           {
-            PropertyName *name = script_->getName(GET_UINT32_INDEX(PC));
+            name0 = script_->getName(GET_UINT32_INDEX(PC));
 
             prepareStubCall(Uses(0));
-            masm.move(ImmPtr(name), Registers::ArgReg1);
+            masm.move(ImmPtr(name0), Registers::ArgReg1);
             INLINE_STUBCALL(stubs::DefVarOrConst, REJOIN_FALLTHROUGH);
           }
           END_CASE(JSOP_DEFVAR)
 
           BEGIN_CASE(JSOP_SETCONST)
           {
-            PropertyName *name = script_->getName(GET_UINT32_INDEX(PC));
+            name0 = script_->getName(GET_UINT32_INDEX(PC));
 
             prepareStubCall(Uses(1));
-            masm.move(ImmPtr(name), Registers::ArgReg1);
+            masm.move(ImmPtr(name0), Registers::ArgReg1);
             INLINE_STUBCALL(stubs::SetConst, REJOIN_FALLTHROUGH);
           }
           END_CASE(JSOP_SETCONST)
@@ -3177,7 +3184,8 @@ mjit::Compiler::generateMethod()
           {
             jsbytecode *next = &PC[JSOP_SETGNAME_LENGTH];
             bool pop = JSOp(*next) == JSOP_POP && !analysis->jumpTarget(next);
-            if (!jsop_setgname(script_->getName(GET_UINT32_INDEX(PC)), pop))
+            name0 = script_->getName(GET_UINT32_INDEX(PC));
+            if (!jsop_setgname(name0, pop))
                 return Compile_Error;
           }
           END_CASE(JSOP_SETGNAME)
@@ -3208,7 +3216,8 @@ mjit::Compiler::generateMethod()
           END_CASE(JSOP_STOP)
 
           BEGIN_CASE(JSOP_GETXPROP)
-            if (!jsop_xname(script_->getName(GET_UINT32_INDEX(PC))))
+            name0 = script_->getName(GET_UINT32_INDEX(PC));
+            if (!jsop_xname(name0))
                 return Compile_Error;
           END_CASE(JSOP_GETXPROP)
 
@@ -4926,7 +4935,7 @@ mjit::Compiler::emitStubCmpOp(BoolStub stub, jsbytecode *target, JSOp fused)
 }
 
 void
-mjit::Compiler::jsop_setprop_slow(PropertyName *name)
+mjit::Compiler::jsop_setprop_slow(HandlePropertyName name)
 {
     JS_ASSERT(*PC == JSOP_SETPROP || *PC == JSOP_SETNAME);
 
@@ -4945,7 +4954,7 @@ mjit::Compiler::jsop_setprop_slow(PropertyName *name)
 }
 
 void
-mjit::Compiler::jsop_getprop_slow(PropertyName *name, bool forPrototype)
+mjit::Compiler::jsop_getprop_slow(HandlePropertyName name, bool forPrototype)
 {
     /* See ::jsop_getprop */
     RejoinState rejoin = forPrototype ? REJOIN_THIS_PROTOTYPE : REJOIN_GETTER;
@@ -4980,7 +4989,7 @@ mjit::Compiler::passICAddress(BaseICInfo *ic)
 }
 
 bool
-mjit::Compiler::jsop_getprop(PropertyName *name, JSValueType knownType,
+mjit::Compiler::jsop_getprop(HandlePropertyName name, JSValueType knownType,
                              bool doTypeCheck, bool forPrototype)
 {
     FrameEntry *top = frame.peek(-1);
@@ -5437,7 +5446,7 @@ mjit::Compiler::testSingletonPropertyTypes(FrameEntry *top, HandleId id, bool *t
 }
 
 bool
-mjit::Compiler::jsop_getprop_dispatch(PropertyName *name)
+mjit::Compiler::jsop_getprop_dispatch(HandlePropertyName name)
 {
     /*
      * Check for a CALLPROP which is a dynamic dispatch: every value it can
@@ -5583,7 +5592,7 @@ mjit::Compiler::jsop_getprop_dispatch(PropertyName *name)
 }
 
 bool
-mjit::Compiler::jsop_setprop(PropertyName *name, bool popGuaranteed)
+mjit::Compiler::jsop_setprop(HandlePropertyName name, bool popGuaranteed)
 {
     FrameEntry *lhs = frame.peek(-2);
     FrameEntry *rhs = frame.peek(-1);
@@ -5772,7 +5781,7 @@ mjit::Compiler::jsop_setprop(PropertyName *name, bool popGuaranteed)
 }
 
 bool
-mjit::Compiler::jsop_intrinsic(PropertyName *name, JSValueType type)
+mjit::Compiler::jsop_intrinsic(HandlePropertyName name, JSValueType type)
 {
     if (type == JSVAL_TYPE_UNKNOWN) {
         prepareStubCall(Uses(0));
@@ -5791,7 +5800,7 @@ mjit::Compiler::jsop_intrinsic(PropertyName *name, JSValueType type)
 }
 
 void
-mjit::Compiler::jsop_name(PropertyName *name, JSValueType type)
+mjit::Compiler::jsop_name(HandlePropertyName name, JSValueType type)
 {
     PICGenInfo pic(ic::PICInfo::NAME, PC);
 
@@ -5847,7 +5856,7 @@ mjit::Compiler::jsop_name(PropertyName *name, JSValueType type)
 }
 
 bool
-mjit::Compiler::jsop_xname(PropertyName *name)
+mjit::Compiler::jsop_xname(HandlePropertyName name)
 {
     PICGenInfo pic(ic::PICInfo::XNAME, PC);
 
@@ -5909,7 +5918,7 @@ mjit::Compiler::jsop_xname(PropertyName *name)
 }
 
 void
-mjit::Compiler::jsop_bindname(PropertyName *name)
+mjit::Compiler::jsop_bindname(HandlePropertyName name)
 {
     PICGenInfo pic(ic::PICInfo::BIND, PC);
 
@@ -5961,7 +5970,7 @@ mjit::Compiler::jsop_bindname(PropertyName *name)
 #else /* !JS_POLYIC */
 
 void
-mjit::Compiler::jsop_name(PropertyName *name, JSValueType type, bool isCall)
+mjit::Compiler::jsop_name(HandlePropertyName name, JSValueType type, bool isCall)
 {
     prepareStubCall(Uses(0));
     INLINE_STUBCALL(isCall ? stubs::CallName : stubs::Name, REJOIN_FALLTHROUGH);
@@ -5972,13 +5981,13 @@ mjit::Compiler::jsop_name(PropertyName *name, JSValueType type, bool isCall)
 }
 
 bool
-mjit::Compiler::jsop_xname(PropertyName *name)
+mjit::Compiler::jsop_xname(HandlePropertyName name)
 {
     return jsop_getprop(name, knownPushedType(0), pushedTypeSet(0));
 }
 
 bool
-mjit::Compiler::jsop_getprop(PropertyName *name, JSValueType knownType, types::TypeSet *typeSet,
+mjit::Compiler::jsop_getprop(HandlePropertyName name, JSValueType knownType, types::TypeSet *typeSet,
                              bool typecheck, bool forPrototype)
 {
     jsop_getprop_slow(name, forPrototype);
@@ -5986,14 +5995,14 @@ mjit::Compiler::jsop_getprop(PropertyName *name, JSValueType knownType, types::T
 }
 
 bool
-mjit::Compiler::jsop_setprop(PropertyName *name)
+mjit::Compiler::jsop_setprop(HandlePropertyName name)
 {
     jsop_setprop_slow(name);
     return true;
 }
 
 void
-mjit::Compiler::jsop_bindname(PropertyName *name)
+mjit::Compiler::jsop_bindname(HandlePropertyName name)
 {
     RegisterID reg = frame.allocReg();
     Address scopeChain(JSFrameReg, StackFrame::offsetOfScopeChain());
@@ -6567,7 +6576,7 @@ mjit::Compiler::jsop_getgname(uint32_t index)
 }
 
 void
-mjit::Compiler::jsop_setgname_slow(PropertyName *name)
+mjit::Compiler::jsop_setgname_slow(HandlePropertyName name)
 {
     prepareStubCall(Uses(2));
     masm.move(ImmPtr(name), Registers::ArgReg1);
@@ -6577,7 +6586,7 @@ mjit::Compiler::jsop_setgname_slow(PropertyName *name)
 }
 
 bool
-mjit::Compiler::jsop_setgname(PropertyName *name, bool popGuaranteed)
+mjit::Compiler::jsop_setgname(HandlePropertyName name, bool popGuaranteed)
 {
     if (monitored(PC)) {
         if (script_ == outerScript)
@@ -7014,7 +7023,7 @@ mjit::Compiler::jsop_regexp()
      * between now and construction of that jitcode could purge the shared
      * info, but such activity will also abort compilation.
      */
-    RegExpGuard g;
+    RegExpGuard g(cx);
     if (!reobj->getShared(cx, &g))
         return false;
 
diff --git a/js/src/methodjit/Compiler.h b/js/src/methodjit/Compiler.h
index fb57dd4902c8..b6f4f532618c 100644
--- a/js/src/methodjit/Compiler.h
+++ b/js/src/methodjit/Compiler.h
@@ -625,9 +625,9 @@ private:
     bool startLoop(jsbytecode *head, Jump entry, jsbytecode *entryTarget);
     bool finishLoop(jsbytecode *head);
     inline bool shouldStartLoop(jsbytecode *head);
-    void jsop_bindname(PropertyName *name);
+    void jsop_bindname(HandlePropertyName name);
     void jsop_setglobal(uint32_t index);
-    void jsop_getprop_slow(PropertyName *name, bool forPrototype = false);
+    void jsop_getprop_slow(HandlePropertyName name, bool forPrototype = false);
     void jsop_aliasedArg(unsigned i, bool get, bool poppedAfter = false);
     void jsop_aliasedVar(ScopeCoordinate sc, bool get, bool poppedAfter = false);
     void jsop_this();
@@ -652,20 +652,20 @@ private:
     void fixPrimitiveReturn(Assembler *masm, FrameEntry *fe);
     bool jsop_getgname(uint32_t index);
     void jsop_getgname_slow(uint32_t index);
-    bool jsop_setgname(PropertyName *name, bool popGuaranteed);
-    void jsop_setgname_slow(PropertyName *name);
+    bool jsop_setgname(HandlePropertyName name, bool popGuaranteed);
+    void jsop_setgname_slow(HandlePropertyName name);
     void jsop_bindgname();
     void jsop_setelem_slow();
     void jsop_getelem_slow();
-    bool jsop_getprop(PropertyName *name, JSValueType type,
+    bool jsop_getprop(HandlePropertyName name, JSValueType type,
                       bool typeCheck = true, bool forPrototype = false);
-    bool jsop_getprop_dispatch(PropertyName *name);
-    bool jsop_setprop(PropertyName *name, bool popGuaranteed);
-    void jsop_setprop_slow(PropertyName *name);
+    bool jsop_getprop_dispatch(HandlePropertyName name);
+    bool jsop_setprop(HandlePropertyName name, bool popGuaranteed);
+    void jsop_setprop_slow(HandlePropertyName name);
     bool jsop_instanceof();
-    bool jsop_intrinsic(PropertyName *name, JSValueType type);
-    void jsop_name(PropertyName *name, JSValueType type);
-    bool jsop_xname(PropertyName *name);
+    bool jsop_intrinsic(HandlePropertyName name, JSValueType type);
+    void jsop_name(HandlePropertyName name, JSValueType type);
+    bool jsop_xname(HandlePropertyName name);
     void enterBlock(StaticBlockObject *block);
     void leaveBlock();
     void emitEval(uint32_t argc);
diff --git a/js/src/methodjit/InvokeHelpers.cpp b/js/src/methodjit/InvokeHelpers.cpp
index 43f9240a8547..b2b8ad9a66d3 100644
--- a/js/src/methodjit/InvokeHelpers.cpp
+++ b/js/src/methodjit/InvokeHelpers.cpp
@@ -287,7 +287,7 @@ UncachedInlineCall(VMFrame &f, InitialFrameFlags initial,
     CallArgs args = CallArgsFromSp(argc, f.regs.sp);
     RootedFunction newfun(cx, args.callee().toFunction());
 
-    RootedScript newscript(cx, newfun->getOrCreateScript(cx));
+    RootedScript newscript(cx, JSFunction::getOrCreateScript(cx, newfun));
     if (!newscript)
         return false;
 
diff --git a/js/src/methodjit/MethodJIT.cpp b/js/src/methodjit/MethodJIT.cpp
index d5672192fb32..e65fc00b6a26 100644
--- a/js/src/methodjit/MethodJIT.cpp
+++ b/js/src/methodjit/MethodJIT.cpp
@@ -1659,6 +1659,11 @@ JITChunk::trace(JSTracer *trc)
         /* We use a manual write barrier in destroyChunk. */
         MarkObjectUnbarriered(trc, &rootedTemplates_[i], "jitchunk_template");
     }
+
+    /* RegExpShared objects require the RegExp source string. */
+    RegExpShared **rootedRegExps_ = rootedRegExps();
+    for (size_t i = 0; i < nRootedRegExps; i++)
+        rootedRegExps_[i]->trace(trc);
 }
 
 void
diff --git a/js/src/methodjit/StubCalls.cpp b/js/src/methodjit/StubCalls.cpp
index 3ddff04175b2..19cbaec2d9f6 100644
--- a/js/src/methodjit/StubCalls.cpp
+++ b/js/src/methodjit/StubCalls.cpp
@@ -100,9 +100,15 @@ stubs::Name(VMFrame &f)
 }
 
 void JS_FASTCALL
-stubs::IntrinsicName(VMFrame &f, PropertyName *name)
+stubs::IntrinsicName(VMFrame &f, PropertyName *nameArg)
 {
     RootedValue rval(f.cx);
+
+    // PropertyNames are atoms and will never be allocated from the nursery,
+    // and the ones passed to this stub are referenced by the script so it will
+    // root them. The compacting GC will discard methodjit code.
+    SkipRoot skip(f.cx, &nameArg);
+    HandlePropertyName name = HandlePropertyName::fromMarkedLocation(&nameArg);
     if (!f.cx->global().get()->getIntrinsicValue(f.cx, name, &rval))
         THROW();
     f.regs.sp[0] = rval;
@@ -839,7 +845,10 @@ stubs::TriggerIonCompile(VMFrame &f)
             osrPC = NULL;
 
         RootedFunction scriptFunction(f.cx, script->function());
-        if (!ion::TestIonCompile(f.cx, script, scriptFunction, osrPC, f.fp()->isConstructing())) {
+        ion::MethodStatus compileStatus =
+            ion::TestIonCompile(f.cx, script, scriptFunction, osrPC, f.fp()->isConstructing());
+
+        if (compileStatus != ion::Method_Compiled) {
             if (f.cx->isExceptionPending())
                 THROW();
         }
diff --git a/js/src/shell/js.cpp b/js/src/shell/js.cpp
index 29ef262c53c4..c2d8a46adf94 100644
--- a/js/src/shell/js.cpp
+++ b/js/src/shell/js.cpp
@@ -1459,7 +1459,7 @@ ValueToScript(JSContext *cx, jsval v, JSFunction **funp = NULL)
         return UnrootedScript(NULL);
 
     RootedScript script(cx);
-    fun->maybeGetOrCreateScript(cx, &script);
+    JSFunction::maybeGetOrCreateScript(cx, fun, &script);
     if (!script)
         JS_ReportErrorNumber(cx, my_GetErrorMessage, NULL, JSSMSG_SCRIPTS_ONLY);
 
@@ -1916,9 +1916,9 @@ DisassembleScript(JSContext *cx, HandleScript script, JSFunction *fun, bool line
             RawObject obj = objects->vector[i];
             if (obj->isFunction()) {
                 Sprint(sp, "\n");
-                RawFunction fun = obj->toFunction();
+                RootedFunction fun(cx, obj->toFunction());
                 RootedScript script(cx);
-                fun->maybeGetOrCreateScript(cx, &script);
+                JSFunction::maybeGetOrCreateScript(cx, fun, &script);
                 if (!DisassembleScript(cx, script, fun, lines, recursive, sp))
                     return false;
             }
@@ -4977,12 +4977,17 @@ BindScriptArgs(JSContext *cx, JSObject *obj_, OptionParser *op)
     return true;
 }
 
+// This function is currently only called from "#if defined(JS_ION)" chunks,
+// so we're guarding the function definition with an #ifdef, too, to avoid
+// build warning for unused function in non-ion-enabled builds:
+#if defined(JS_ION)
 static int
 OptionFailure(const char *option, const char *str)
 {
     fprintf(stderr, "Unrecognized option for %s: %s\n", option, str);
     return EXIT_FAILURE;
 }
+#endif /* JS_ION */
 
 static int
 ProcessArgs(JSContext *cx, JSObject *obj_, OptionParser *op)
diff --git a/js/src/tests/js1_6/shell.js b/js/src/tests/js1_6/shell.js
index e69de29bb2d1..d378e171db67 100644
--- a/js/src/tests/js1_6/shell.js
+++ b/js/src/tests/js1_6/shell.js
@@ -0,0 +1,13 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+
+// explicitly turn on js16
+if (typeof version != 'undefined')
+{
+  version(160);
+}
+
diff --git a/js/src/vm/Debugger.cpp b/js/src/vm/Debugger.cpp
index 7c4a4107b641..d2afb2c64ba2 100644
--- a/js/src/vm/Debugger.cpp
+++ b/js/src/vm/Debugger.cpp
@@ -2312,18 +2312,18 @@ class Debugger::ScriptQuery {
      * Search all relevant compartments and the stack for scripts matching
      * this query, and append the matching scripts to |vector|.
      */
-    bool findScripts(AutoScriptVector *vector) {
-        AutoAssertNoGC nogc;
-
+    bool findScripts(AutoScriptVector *v) {
         if (!prepareQuery())
             return false;
 
         /* Search each compartment for debuggee scripts. */
+        vector = v;
+        oom = false;
         for (CompartmentSet::Range r = compartments.all(); !r.empty(); r.popFront()) {
-            for (gc::CellIter i(r.front(), gc::FINALIZE_SCRIPT); !i.done(); i.next()) {
-                RawScript script = i.get<JSScript>();
-                if (!consider(script, vector))
-                    return false;
+            IterateCells(cx->runtime, r.front(), gc::FINALIZE_SCRIPT, this, considerCell);
+            if (oom) {
+                js_ReportOutOfMemory(cx);
+                return false;
             }
         }
 
@@ -2337,7 +2337,7 @@ class Debugger::ScriptQuery {
             for (CompartmentToScriptMap::Range r = innermostForCompartment.all();
                  !r.empty();
                  r.popFront()) {
-                if (!vector->append(r.front().value)) {
+                if (!v->append(r.front().value)) {
                     js_ReportOutOfMemory(cx);
                     return false;
                 }
@@ -2385,6 +2385,12 @@ class Debugger::ScriptQuery {
      */
     CompartmentToScriptMap innermostForCompartment;
 
+    /* The vector to which to append the scripts found. */
+    AutoScriptVector *vector;
+
+    /* Indicates whether OOM has occurred while matching. */
+    bool oom;
+
     /* Arrange for this ScriptQuery to match only scripts that run in |global|. */
     bool matchSingleGlobal(GlobalObject *global) {
         JS_ASSERT(compartments.count() == 0);
@@ -2425,22 +2431,30 @@ class Debugger::ScriptQuery {
         return true;
     }
 
+    static void considerCell(JSRuntime *rt, void *data, void *thing,
+                             JSGCTraceKind traceKind, size_t thingSize) {
+        ScriptQuery *self = static_cast<ScriptQuery *>(data);
+        self->consider(static_cast<JSScript *>(thing));
+    }
+
     /*
      * If |script| matches this query, append it to |vector| or place it in
-     * |innermostForCompartment|, as appropriate. Return true if no error
-     * occurs, false if an error occurs.
+     * |innermostForCompartment|, as appropriate. Set |oom| if an out of memory
+     * condition occurred.
      */
-    bool consider(JSScript *script, AutoScriptVector *vector) {
+    void consider(JSScript *script) {
+        if (oom)
+            return;
         JSCompartment *compartment = script->compartment();
         if (!compartments.has(compartment))
-            return true;
+            return;
         if (urlCString.ptr()) {
             if (!script->filename || strcmp(script->filename, urlCString.ptr()) != 0)
-                return true;
+                return;
         }
         if (hasLine) {
             if (line < script->lineno || script->lineno + js_GetScriptLineExtent(script) < line)
-                return true;
+                return;
         }
         if (innermost) {
             /*
@@ -2467,19 +2481,19 @@ class Debugger::ScriptQuery {
                  * compartment, so it is thus the innermost such script.
                  */
                 if (!innermostForCompartment.add(p, compartment, script)) {
-                    js_ReportOutOfMemory(cx);
-                    return false;
+                    oom = true;
+                    return;
                 }
             }
         } else {
             /* Record this matching script in the results vector. */
             if (!vector->append(script)) {
-                js_ReportOutOfMemory(cx);
-                return false;
+                oom = true;
+                return;
             }
         }
 
-        return true;
+        return;
     }
 };
 
diff --git a/js/src/vm/ForkJoin.cpp b/js/src/vm/ForkJoin.cpp
index c2b45e69413d..7c804ef4257b 100644
--- a/js/src/vm/ForkJoin.cpp
+++ b/js/src/vm/ForkJoin.cpp
@@ -139,7 +139,7 @@ class js::AutoRendezvous
     }
 };
 
-PRUintn ForkJoinSlice::ThreadPrivateIndex;
+unsigned ForkJoinSlice::ThreadPrivateIndex;
 
 class js::AutoSetForkJoinSlice
 {
diff --git a/js/src/vm/ForkJoin.h b/js/src/vm/ForkJoin.h
index 8cb5c0d837f4..ef192c16bcd7 100644
--- a/js/src/vm/ForkJoin.h
+++ b/js/src/vm/ForkJoin.h
@@ -155,7 +155,7 @@ struct ForkJoinSlice
 
 #ifdef JS_THREADSAFE
     // Initialized by Initialize()
-    static PRUintn ThreadPrivateIndex;
+    static unsigned ThreadPrivateIndex;
 #endif
 
     ForkJoinShared *const shared;
diff --git a/js/src/vm/GlobalObject.h b/js/src/vm/GlobalObject.h
index 3261c45457e7..af6395ea483d 100644
--- a/js/src/vm/GlobalObject.h
+++ b/js/src/vm/GlobalObject.h
@@ -382,13 +382,12 @@ class GlobalObject : public JSObject
         return &getSlotRef(INTRINSICS).toObject();
     }
 
-    bool getIntrinsicValue(JSContext *cx, PropertyName *name, MutableHandleValue value) {
+    bool getIntrinsicValue(JSContext *cx, HandlePropertyName name, MutableHandleValue value) {
         RootedObject holder(cx, intrinsicsHolder());
         RootedId id(cx, NameToId(name));
         if (HasDataProperty(cx, holder, id, value.address()))
             return true;
-        Rooted<PropertyName*> rootedName(cx, name);
-        if (!cx->runtime->cloneSelfHostedValue(cx, rootedName, value))
+        if (!cx->runtime->cloneSelfHostedValue(cx, name, value))
             return false;
         mozilla::DebugOnly<bool> ok = JS_DefinePropertyById(cx, holder, id, value, NULL, NULL, 0);
         JS_ASSERT(ok);
diff --git a/js/src/vm/RegExpObject.cpp b/js/src/vm/RegExpObject.cpp
index 4e6c910bab45..b0d01d64ba02 100644
--- a/js/src/vm/RegExpObject.cpp
+++ b/js/src/vm/RegExpObject.cpp
@@ -101,7 +101,7 @@ RegExpObjectBuilder::clone(Handle<RegExpObject *> other, Handle<RegExpObject *>
         return build(source, newFlags);
     }
 
-    RegExpGuard g;
+    RegExpGuard g(cx);
     if (!other->getShared(cx, &g))
         return NULL;
 
@@ -405,6 +405,12 @@ RegExpShared::~RegExpShared()
         js_delete<BytecodePattern>(bytecode);
 }
 
+void
+RegExpShared::trace(JSTracer *trc)
+{
+    MarkString(trc, &source, "regexpshared source");
+}
+
 void
 RegExpShared::reportYarrError(JSContext *cx, TokenStream *ts, ErrorCode error)
 {
diff --git a/js/src/vm/RegExpObject.h b/js/src/vm/RegExpObject.h
index b2607a1509f5..0a7ca61f6fe6 100644
--- a/js/src/vm/RegExpObject.h
+++ b/js/src/vm/RegExpObject.h
@@ -120,11 +120,11 @@ class RegExpShared
 #endif
 
     /*
-     * Source to the RegExp. Safe to hold: if the RegExpShared is active,
-     * then at least one RegExpObject must be referencing the RegExpShared,
-     * and the RegExpObject keeps alive the source JSAtom.
+     * Source to the RegExp. The RegExpShared must either be protected by a
+     * RegExpGuard, which handles rooting for stacky RegExpShareds,
+     * or trace() must be explicitly called during marking.
      */
-    JSAtom *           source;
+    HeapPtrAtom        source;
     RegExpFlag         flags;
     unsigned           parenCount;
 
@@ -149,6 +149,8 @@ class RegExpShared
     RegExpShared(JSRuntime *rt, JSAtom *source, RegExpFlag flags);
     ~RegExpShared();
 
+    void trace(JSTracer *trc);
+
     /* Static functions to expose some Yarr logic. */
     static inline bool isJITRuntimeEnabled(JSContext *cx);
     static void reportYarrError(JSContext *cx, TokenStream *ts, ErrorCode error);
@@ -198,22 +200,41 @@ class RegExpShared
 class RegExpGuard
 {
     RegExpShared *re_;
+
+    /*
+     * Prevent the RegExp source from being collected:
+     * because RegExpShared objects compile at execution time, the source
+     * must remain rooted for the active lifetime of the RegExpShared.
+     */
+    RootedAtom source_;
+
     RegExpGuard(const RegExpGuard &) MOZ_DELETE;
     void operator=(const RegExpGuard &) MOZ_DELETE;
+
   public:
-    RegExpGuard() : re_(NULL) {}
-    RegExpGuard(RegExpShared &re) : re_(&re) {
-        re_->incRef();
-    }
-    void init(RegExpShared &re) {
-        JS_ASSERT(!re_);
-        re_ = &re;
+    RegExpGuard(JSContext *cx)
+      : re_(NULL), source_(cx)
+    { }
+
+    RegExpGuard(JSContext *cx, RegExpShared &re)
+      : re_(&re), source_(cx, re.source)
+    {
         re_->incRef();
     }
+
     ~RegExpGuard() {
         if (re_)
             re_->decRef();
     }
+
+  public:
+    void init(RegExpShared &re) {
+        JS_ASSERT(!re_);
+        re_ = &re;
+        re_->incRef();
+        source_ = re.source;
+    }
+
     bool initialized() const { return !!re_; }
     RegExpShared *re() const { JS_ASSERT(initialized()); return re_; }
     RegExpShared *operator->() { return re(); }
diff --git a/js/src/vm/RegExpStatics.cpp b/js/src/vm/RegExpStatics.cpp
index 3834c02e03a9..49964b122ffc 100644
--- a/js/src/vm/RegExpStatics.cpp
+++ b/js/src/vm/RegExpStatics.cpp
@@ -87,7 +87,7 @@ RegExpStatics::executeLazy(JSContext *cx)
     StableCharPtr chars(matchesInput->chars(), length);
 
     /* Execute the full regular expression. */
-    RegExpGuard shared;
+    RegExpGuard shared(cx);
     if (!regexp->getShared(cx, &shared))
         return false;
 
diff --git a/js/xpconnect/loader/mozJSComponentLoader.cpp b/js/xpconnect/loader/mozJSComponentLoader.cpp
index e68cab25a3d6..bc6677c3c70a 100644
--- a/js/xpconnect/loader/mozJSComponentLoader.cpp
+++ b/js/xpconnect/loader/mozJSComponentLoader.cpp
@@ -282,12 +282,56 @@ File(JSContext *cx, unsigned argc, jsval *vp)
     return true;
 }
 
+static JSBool
+Blob(JSContext *cx, unsigned argc, jsval *vp)
+{
+    nsresult rv;
+
+    nsCOMPtr<nsISupports> native;
+    rv = nsDOMMultipartFile::NewBlob(getter_AddRefs(native));
+    if (NS_FAILED(rv)) {
+        XPCThrower::Throw(rv, cx);
+        return false;
+    }
+
+    nsCOMPtr<nsIJSNativeInitializer> initializer = do_QueryInterface(native);
+    NS_ASSERTION(initializer, "what?");
+
+    rv = initializer->Initialize(nullptr, cx, nullptr, argc, JS_ARGV(cx, vp));
+    if (NS_FAILED(rv)) {
+        XPCThrower::Throw(rv, cx);
+        return false;
+    }
+
+    nsXPConnect* xpc = nsXPConnect::GetXPConnect();
+    if (!xpc) {
+        XPCThrower::Throw(NS_ERROR_UNEXPECTED, cx);
+        return false;
+    }
+
+    JSObject* glob = JS_GetGlobalForScopeChain(cx);
+
+    nsCOMPtr<nsIXPConnectJSObjectHolder> holder;
+    jsval retval;
+    rv = xpc->WrapNativeToJSVal(cx, glob, native, nullptr,
+                                &NS_GET_IID(nsISupports),
+                                true, &retval, nullptr);
+    if (NS_FAILED(rv)) {
+        XPCThrower::Throw(rv, cx);
+        return false;
+    }
+
+    JS_SET_RVAL(cx, vp, retval);
+    return true;
+}
+
 static JSFunctionSpec gGlobalFun[] = {
     JS_FS("dump",    Dump,   1,0),
     JS_FS("debug",   Debug,  1,0),
     JS_FS("atob",    Atob,   1,0),
     JS_FS("btoa",    Btoa,   1,0),
     JS_FS("File",    File,   1,JSFUN_CONSTRUCTOR),
+    JS_FS("Blob",    Blob,   2,JSFUN_CONSTRUCTOR),
     JS_FS_END
 };
 
diff --git a/js/xpconnect/src/XPCConvert.cpp b/js/xpconnect/src/XPCConvert.cpp
index 2f573a33f75e..54ad9a0d56cf 100644
--- a/js/xpconnect/src/XPCConvert.cpp
+++ b/js/xpconnect/src/XPCConvert.cpp
@@ -1524,7 +1524,8 @@ CheckTargetAndPopulate(const nsXPTType& type,
 // are not accepted; create a properly typed array view on them
 // first. The element type of array must match the XPCOM
 // type in size, type and signedness exactly. As an exception,
-// Uint8ClampedArray is allowed for arrays of uint8_t.
+// Uint8ClampedArray is allowed for arrays of uint8_t. DataViews
+// are not supported.
 
 // static
 JSBool
@@ -1550,7 +1551,7 @@ XPCConvert::JSTypedArray2Native(void** d,
 
     void* output = nullptr;
 
-    switch (JS_GetTypedArrayType(jsArray)) {
+    switch (JS_GetArrayBufferViewType(jsArray)) {
     case js::ArrayBufferView::TYPE_INT8:
         if (!CheckTargetAndPopulate(nsXPTType::T_I8, type,
                                     sizeof(int8_t), count,
diff --git a/js/xpconnect/src/XPCJSRuntime.cpp b/js/xpconnect/src/XPCJSRuntime.cpp
index 9f32f3a8f72c..63f3b46c4ed0 100644
--- a/js/xpconnect/src/XPCJSRuntime.cpp
+++ b/js/xpconnect/src/XPCJSRuntime.cpp
@@ -431,11 +431,12 @@ CanSkipWrappedJS(nsXPCWrappedJS *wrappedJS)
     // If traversing wrappedJS wouldn't release it, nor
     // cause any other objects to be added to the graph, no
     // need to add it to the graph at all.
+    bool isRootWrappedJS = wrappedJS->GetRootWrapper() == wrappedJS;
     if (nsCCUncollectableMarker::sGeneration &&
         (!obj || !xpc_IsGrayGCThing(obj)) &&
         !wrappedJS->IsSubjectToFinalization() &&
-        wrappedJS->GetRootWrapper() == wrappedJS) {
-        if (!wrappedJS->IsAggregatedToNative()) {
+        (isRootWrappedJS || CanSkipWrappedJS(wrappedJS->GetRootWrapper()))) {
+        if (!wrappedJS->IsAggregatedToNative() || !isRootWrappedJS) {
             return true;
         } else {
             nsISupports* agg = wrappedJS->GetAggregatedNativeObject();
diff --git a/js/xpconnect/src/dictionary_helper_gen.py b/js/xpconnect/src/dictionary_helper_gen.py
index e36f53867571..d170b1632701 100644
--- a/js/xpconnect/src/dictionary_helper_gen.py
+++ b/js/xpconnect/src/dictionary_helper_gen.py
@@ -265,18 +265,23 @@ def init_value(attribute):
             return "JSVAL_VOID"
         return "0"
     else:
+        if realtype.count("double") and attribute.defvalue == "Infinity":
+            return "MOZ_DOUBLE_POSITIVE_INFINITY()"
+        if realtype.count("double") and attribute.defvalue == "-Infinity":
+            return "MOZ_DOUBLE_NEGATIVE_INFINITY()"
         if realtype.count("nsAString"):
             return "NS_LITERAL_STRING(\"%s\")" % attribute.defvalue
         if realtype.count("nsACString"):
             return "NS_LITERAL_CSTRING(\"%s\")" % attribute.defvalue
-        raise xpidl.IDLError("Default value is not supported for type %s" % realtype)
+        raise xpidl.IDLError("Default value of %s is not supported for type %s" %
+                             (attribute.defvalue, realtype), attribute.location)
 
 def write_header(iface, fd):
     attributes = []
     for member in iface.members:
         if isinstance(member, xpidl.Attribute):
             attributes.append(member)
-    
+
     fd.write("class %s" % iface.name)
     if iface.base is not None:
         fd.write(" : public %s" % iface.base)
@@ -287,7 +292,7 @@ def write_header(iface, fd):
     fd.write("  // If aCx or aVal is null, NS_OK is returned and \n"
              "  // dictionary will use the default values. \n"
              "  nsresult Init(JSContext* aCx, const jsval* aVal);\n")
-    
+
     fd.write("\n")
 
     for member in attributes:
diff --git a/js/xpconnect/src/nsXPConnect.cpp b/js/xpconnect/src/nsXPConnect.cpp
index 7ae3aab25bf9..77c9ef9b25b7 100644
--- a/js/xpconnect/src/nsXPConnect.cpp
+++ b/js/xpconnect/src/nsXPConnect.cpp
@@ -473,6 +473,72 @@ TraceWeakMapping(js::WeakMapTracer *trc, JSObject *m,
     }
 }
 
+// This is based on the logic in TraceWeakMapping.
+struct FixWeakMappingGrayBitsTracer : public js::WeakMapTracer
+{
+    FixWeakMappingGrayBitsTracer(JSRuntime *rt)
+        : js::WeakMapTracer(rt, FixWeakMappingGrayBits)
+    {}
+
+    void
+    FixAll()
+    {
+        do {
+            mAnyMarked = false;
+            js::TraceWeakMaps(this);
+        } while (mAnyMarked);
+    }
+
+private:
+
+    static void
+    FixWeakMappingGrayBits(js::WeakMapTracer *trc, JSObject *m,
+                           void *k, JSGCTraceKind kkind,
+                           void *v, JSGCTraceKind vkind)
+    {
+        MOZ_ASSERT(!js::IsIncrementalBarrierNeeded(trc->runtime),
+                   "Don't call FixWeakMappingGrayBits during a GC.");
+
+        FixWeakMappingGrayBitsTracer *tracer = static_cast<FixWeakMappingGrayBitsTracer*>(trc);
+
+        // If nothing that could be held alive by this entry is marked gray, return.
+        bool delegateMightNeedMarking = k && xpc_IsGrayGCThing(k);
+        bool valueMightNeedMarking = v && xpc_IsGrayGCThing(v) && vkind != JSTRACE_STRING;
+        if (!delegateMightNeedMarking && !valueMightNeedMarking)
+            return;
+
+        if (!AddToCCKind(kkind))
+            k = nullptr;
+
+        if (delegateMightNeedMarking && kkind == JSTRACE_OBJECT) {
+            JSObject *kdelegate = js::GetWeakmapKeyDelegate((JSObject *)k);
+            if (kdelegate && !xpc_IsGrayGCThing(kdelegate)) {
+                js::UnmarkGrayGCThingRecursively(k, JSTRACE_OBJECT);
+                tracer->mAnyMarked = true;
+            }
+        }
+
+        if (v && xpc_IsGrayGCThing(v) &&
+            (!k || !xpc_IsGrayGCThing(k)) &&
+            (!m || !xpc_IsGrayGCThing(m)) &&
+            vkind != JSTRACE_SHAPE)
+        {
+            js::UnmarkGrayGCThingRecursively(v, vkind);
+            tracer->mAnyMarked = true;
+        }
+
+    }
+
+    bool mAnyMarked;
+};
+
+void
+nsXPConnect::FixWeakMappingGrayBits()
+{
+    FixWeakMappingGrayBitsTracer fixer(GetRuntime()->GetJSRuntime());
+    fixer.FixAll();
+}
+
 nsresult
 nsXPConnect::BeginCycleCollection(nsCycleCollectionTraversalCallback &cb)
 {
diff --git a/js/xpconnect/src/xpcprivate.h b/js/xpconnect/src/xpcprivate.h
index f5c5bace357f..402d95b98748 100644
--- a/js/xpconnect/src/xpcprivate.h
+++ b/js/xpconnect/src/xpcprivate.h
@@ -525,7 +525,7 @@ public:
     nsresult GetInfoForIID(const nsIID * aIID, nsIInterfaceInfo** info);
     nsresult GetInfoForName(const char * name, nsIInterfaceInfo** info);
 
-    // nsCycleCollectionLanguageRuntime
+    // nsCycleCollectionJSRuntime
     virtual bool NotifyLeaveMainThread();
     virtual void NotifyEnterCycleCollectionThread();
     virtual void NotifyLeaveCycleCollectionThread();
@@ -533,6 +533,7 @@ public:
     virtual nsresult BeginCycleCollection(nsCycleCollectionTraversalCallback &cb);
     virtual nsresult FinishTraverse();
     virtual nsCycleCollectionParticipant *GetParticipant();
+    virtual void FixWeakMappingGrayBits();
     virtual bool NeedCollect();
     virtual void Collect(uint32_t reason);
 
diff --git a/js/xpconnect/tests/unit/component-blob.js b/js/xpconnect/tests/unit/component-blob.js
new file mode 100644
index 000000000000..e153e01545a9
--- /dev/null
+++ b/js/xpconnect/tests/unit/component-blob.js
@@ -0,0 +1,85 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
+
+const Cc = Components.classes;
+const Ci = Components.interfaces;
+const Cu = Components.utils;
+
+function do_check_true(cond, text) {
+  // we don't have the test harness' utilities in this scope, so we need this
+  // little helper. In the failure case, the exception is propagated to the
+  // caller in the main run_test() function, and the test fails.
+  if (!cond)
+    throw "Failed check: " + text;
+}
+
+function BlobComponent() {
+  this.wrappedJSObject = this;
+}
+BlobComponent.prototype =
+{
+  doTest: function() {
+    // throw if anything goes wrong
+    let testContent = "<a id=\"a\"><b id=\"b\">hey!<\/b><\/a>";
+    // should be able to construct a file
+    var f1 = Blob([testContent], {"type" : "text/xml"});
+    // with either constructor syntax
+    var f2 = new Blob([testContent], {"type" : "text/xml"});
+
+    // do some tests
+    do_check_true(f1 instanceof Ci.nsIDOMBlob, "Should be a DOM Blob");
+    do_check_true(f2 instanceof Ci.nsIDOMBlob, "Should be a DOM Blob");
+
+    do_check_true(!(f1 instanceof Ci.nsIDOMFile), "Should not be a DOM File");
+    do_check_true(!(f2 instanceof Ci.nsIDOMFile), "Should not be a DOM File");
+
+    do_check_true(f1.type == "text/xml", "Wrong type");
+    do_check_true(f2.type == "text/xml", "Wrong type");
+
+    do_check_true(f1.size == testContent.length, "Wrong content size");
+    do_check_true(f2.size == testContent.length, "Wrong content size");
+
+    var f3 = new Blob();
+    do_check_true(f3.size == 0, "Wrong size");
+    do_check_true(f3.type == "", "Wrong type");
+
+    var threw = false;
+    try {
+      // Needs a valid ctor argument
+      var f3 = Blob(Date(132131532));
+    } catch (e) {
+      threw = true;
+    }
+    do_check_true(threw, "Passing a random object should fail");
+
+    return true;
+  },
+
+  // nsIClassInfo + information for XPCOM registration code in XPCOMUtils.jsm
+  classDescription: "Blob in components scope code",
+  classID: Components.ID("{06215993-a3c2-41e3-bdfd-0a3a2cc0b65c}"),
+  contractID: "@mozilla.org/tests/component-blob;1",
+
+  // nsIClassInfo
+  implementationLanguage: Components.interfaces.nsIProgrammingLanguage.JAVASCRIPT,
+  flags: 0,
+
+  getInterfaces: function getInterfaces(aCount) {
+    var interfaces = [Components.interfaces.nsIClassInfo];
+    aCount.value = interfaces.length;
+    return interfaces;
+  },
+
+  getHelperForLanguage: function getHelperForLanguage(aLanguage) {
+    return null;
+  },
+
+  // nsISupports
+  QueryInterface: XPCOMUtils.generateQI([Components.interfaces.nsIClassInfo])
+};
+
+var gComponentsArray = [BlobComponent];
+this.NSGetFactory = XPCOMUtils.generateNSGetFactory(gComponentsArray);
diff --git a/js/xpconnect/tests/unit/component-blob.manifest b/js/xpconnect/tests/unit/component-blob.manifest
new file mode 100644
index 000000000000..ac264c06d558
--- /dev/null
+++ b/js/xpconnect/tests/unit/component-blob.manifest
@@ -0,0 +1,2 @@
+component {06215993-a3c2-41e3-bdfd-0a3a2cc0b65c} component-blob.js
+contract @mozilla.org/tests/component-blob;1 {06215993-a3c2-41e3-bdfd-0a3a2cc0b65c}
diff --git a/js/xpconnect/tests/unit/test_blob.js b/js/xpconnect/tests/unit/test_blob.js
new file mode 100644
index 000000000000..039f45102ef7
--- /dev/null
+++ b/js/xpconnect/tests/unit/test_blob.js
@@ -0,0 +1,16 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+ 
+function run_test() {   
+  do_load_manifest("component-blob.manifest");
+  const contractID = "@mozilla.org/tests/component-blob;1";
+  do_check_true(contractID in Components.classes);
+  var foo = Components.classes[contractID]
+                      .createInstance(Components.interfaces.nsIClassInfo);
+  do_check_true(Boolean(foo));
+  do_check_true(foo.contractID == contractID);
+  do_check_true(!!foo.wrappedJSObject);
+  do_check_true(foo.wrappedJSObject.doTest());
+
+}
diff --git a/js/xpconnect/tests/unit/xpcshell.ini b/js/xpconnect/tests/unit/xpcshell.ini
index d677ef9414d9..b7d0bc2d396f 100644
--- a/js/xpconnect/tests/unit/xpcshell.ini
+++ b/js/xpconnect/tests/unit/xpcshell.ini
@@ -15,6 +15,7 @@ tail =
 [test_bug780370.js]
 [test_bug_442086.js]
 [test_file.js]
+[test_blob.js]
 [test_import.js]
 [test_import_fail.js]
 [test_js_weak_references.js]
diff --git a/layout/base/FrameLayerBuilder.cpp b/layout/base/FrameLayerBuilder.cpp
index 2386ab9d1b9e..8de5dbe04f41 100644
--- a/layout/base/FrameLayerBuilder.cpp
+++ b/layout/base/FrameLayerBuilder.cpp
@@ -2782,6 +2782,8 @@ ChooseScaleAndSetTransform(FrameLayerBuilder* aLayerBuilder,
   aLayer->SetBaseTransform(transform);
   aLayer->SetPreScale(1.0f/float(scale.width),
                       1.0f/float(scale.height));
+  aLayer->SetInheritedScale(aIncomingScale.mXScale,
+                            aIncomingScale.mYScale);
 
   FrameLayerBuilder::ContainerParameters
     result(scale.width, scale.height, -offset, aIncomingScale);
diff --git a/layout/base/nsCSSFrameConstructor.cpp b/layout/base/nsCSSFrameConstructor.cpp
index 3f379f4e155b..2c9d52697bd8 100644
--- a/layout/base/nsCSSFrameConstructor.cpp
+++ b/layout/base/nsCSSFrameConstructor.cpp
@@ -2294,7 +2294,7 @@ nsCSSFrameConstructor::ConstructDocElementFrame(Element*                 aDocEle
                                 nullptr, aFrameState);
   // Initialize the ancestor filter with null for now; we'll push
   // aDocElement once we finish resolving style for it.
-  state.mTreeMatchContext.mAncestorFilter.Init(nullptr);
+  state.mTreeMatchContext.InitAncestors(nullptr);
 
   // XXXbz why, exactly?
   if (!mTempFrameTreeState)
@@ -2361,8 +2361,8 @@ nsCSSFrameConstructor::ConstructDocElementFrame(Element*                 aDocEle
     return NS_OK;
   }
 
-  AncestorFilter::AutoAncestorPusher
-    ancestorPusher(true, state.mTreeMatchContext.mAncestorFilter, aDocElement);
+  TreeMatchContext::AutoAncestorPusher
+    ancestorPusher(true, state.mTreeMatchContext, aDocElement);
 
   // Make sure to start any background image loads for the root element now.
   styleContext->StartBackgroundImageLoads();
@@ -3571,9 +3571,9 @@ nsCSSFrameConstructor::ConstructFrameFromItemInternal(FrameConstructionItem& aIt
   // frames constructed), this is the best place to bottleneck the
   // pushing of the content instead of having to do it in multiple
   // places.
-  AncestorFilter::AutoAncestorPusher
+  TreeMatchContext::AutoAncestorPusher
     ancestorPusher(aState.mTreeMatchContext.mAncestorFilter.HasFilter(),
-                   aState.mTreeMatchContext.mAncestorFilter,
+                   aState.mTreeMatchContext,
                    content->IsElement() ? content->AsElement() : nullptr);
 
   nsIFrame* newFrame;
@@ -3807,9 +3807,9 @@ nsCSSFrameConstructor::CreateAnonymousFrames(nsFrameConstructorState& aState,
 
   nsFrameConstructorState::PendingBindingAutoPusher pusher(aState,
                                                            aPendingBinding);
-  AncestorFilter::AutoAncestorPusher
+  TreeMatchContext::AutoAncestorPusher
     ancestorPusher(aState.mTreeMatchContext.mAncestorFilter.HasFilter(),
-                   aState.mTreeMatchContext.mAncestorFilter,
+                   aState.mTreeMatchContext,
                    aParent->AsElement());
 
   nsIAnonymousContentCreator* creator = do_QueryFrame(aParentFrame);
@@ -6608,7 +6608,7 @@ nsCSSFrameConstructor::ContentAppended(nsIContent*     aContainer,
   nsFrameConstructorState state(mPresShell, mFixedContainingBlock,
                                 GetAbsoluteContainingBlock(parentFrame),
                                 GetFloatContainingBlock(parentFrame));
-  state.mTreeMatchContext.mAncestorFilter.Init(aContainer->AsElement());
+  state.mTreeMatchContext.InitAncestors(aContainer->AsElement());
 
   // See if the containing block has :first-letter style applied.
   bool haveFirstLetterStyle = false, haveFirstLineStyle = false;
@@ -7044,9 +7044,9 @@ nsCSSFrameConstructor::ContentRangeInserted(nsIContent*            aContainer,
                                 GetAbsoluteContainingBlock(parentFrame),
                                 GetFloatContainingBlock(parentFrame),
                                 aFrameState);
-  state.mTreeMatchContext.mAncestorFilter.Init(aContainer ?
-                                                 aContainer->AsElement() :
-                                                 nullptr);
+  state.mTreeMatchContext.InitAncestors(aContainer ?
+                                          aContainer->AsElement() :
+                                          nullptr);
 
   // Recover state for the containing block - we need to know if
   // it has :first-letter or :first-line style applied to it. The
@@ -11281,9 +11281,9 @@ nsCSSFrameConstructor::BuildInlineChildItems(nsFrameConstructorState& aState,
   nsStyleContext* const parentStyleContext = aParentItem.mStyleContext;
   nsIContent* const parentContent = aParentItem.mContent;
 
-  AncestorFilter::AutoAncestorPusher
+  TreeMatchContext::AutoAncestorPusher
     ancestorPusher(aState.mTreeMatchContext.mAncestorFilter.HasFilter(),
-                   aState.mTreeMatchContext.mAncestorFilter,
+                   aState.mTreeMatchContext,
                    parentContent->AsElement());
   
   CreateGeneratedContentItem(aState, nullptr, parentContent, parentStyleContext,
diff --git a/layout/base/nsDocumentViewer.cpp b/layout/base/nsDocumentViewer.cpp
index a8f3cfc43811..eeea9038a6c1 100644
--- a/layout/base/nsDocumentViewer.cpp
+++ b/layout/base/nsDocumentViewer.cpp
@@ -1624,6 +1624,9 @@ nsDocumentViewer::Destroy()
 
   // The document was not put in the bfcache
 
+  if (mPresShell) {
+    DestroyPresShell();
+  }
   if (mDocument) {
     mDocument->Destroy();
     mDocument = nullptr;
@@ -1657,10 +1660,6 @@ nsDocumentViewer::Destroy()
 
   mDeviceContext = nullptr;
 
-  if (mPresShell) {
-    DestroyPresShell();
-  }
-
   if (mPresContext) {
     DestroyPresContext();
   }
diff --git a/layout/base/nsFrameManager.cpp b/layout/base/nsFrameManager.cpp
index 72c6eec4452c..dcb78e9bb6e5 100644
--- a/layout/base/nsFrameManager.cpp
+++ b/layout/base/nsFrameManager.cpp
@@ -1379,8 +1379,8 @@ nsFrameManager::ReResolveStyleContext(nsPresContext     *aPresContext,
     if (checkUndisplayed && mUndisplayedMap) {
       UndisplayedNode* undisplayed =
         mUndisplayedMap->GetFirstNode(undisplayedParent);
-      for (AncestorFilter::AutoAncestorPusher
-             pushAncestor(undisplayed, aTreeMatchContext.mAncestorFilter,
+      for (TreeMatchContext::AutoAncestorPusher
+             pushAncestor(undisplayed, aTreeMatchContext,
                           undisplayedParent ? undisplayedParent->AsElement()
                                             : nullptr);
            undisplayed; undisplayed = undisplayed->mNext) {
@@ -1536,9 +1536,9 @@ nsFrameManager::ReResolveStyleContext(nsPresContext     *aPresContext,
 
       // now do children
       nsIFrame::ChildListIterator lists(aFrame);
-      for (AncestorFilter::AutoAncestorPusher
+      for (TreeMatchContext::AutoAncestorPusher
              pushAncestor(!lists.IsDone(),
-                          aTreeMatchContext.mAncestorFilter,
+                          aTreeMatchContext,
                           content && content->IsElement() ? content->AsElement()
                                                           : nullptr);
            !lists.IsDone(); lists.Next()) {
@@ -1680,7 +1680,7 @@ nsFrameManager::ComputeStyleChangeFor(nsIFrame          *aFrame,
   nsIContent *parent = content ? content->GetParent() : nullptr;
   Element *parentElement =
     parent && parent->IsElement() ? parent->AsElement() : nullptr;
-  treeMatchContext.mAncestorFilter.Init(parentElement);
+  treeMatchContext.InitAncestors(parentElement);
   nsTArray<nsIContent*> visibleKidsOfHiddenElement;
   do {
     // Outer loop over special siblings
diff --git a/layout/base/nsIPresShell.h b/layout/base/nsIPresShell.h
index afc91f51df71..fb8e6e2531dd 100644
--- a/layout/base/nsIPresShell.h
+++ b/layout/base/nsIPresShell.h
@@ -1424,6 +1424,9 @@ protected:
   // re-use old pixels.
   RenderFlags               mRenderFlags;
 
+  // Indicates that the whole document must be restyled.  Changes to scoped
+  // style sheets are recorded in mChangedScopeStyleRoots rather than here
+  // in mStylesHaveChanged.
   bool                      mStylesHaveChanged : 1;
   bool                      mDidInitialize : 1;
   bool                      mIsDestroying : 1;
@@ -1447,6 +1450,15 @@ protected:
   bool                      mSuppressInterruptibleReflows : 1;
   bool                      mScrollPositionClampingScrollPortSizeSet : 1;
 
+  // List of subtrees rooted at style scope roots that need to be restyled.
+  // When a change to a scoped style sheet is made, we add the style scope
+  // root to this array rather than setting mStylesHaveChanged = true, since
+  // we know we don't need to restyle the whole document.  However, if in the
+  // same update block we have already had other changes that require
+  // the whole document to be restyled (i.e., mStylesHaveChanged is already
+  // true), then we don't bother adding the scope root here.
+  nsAutoTArray<nsRefPtr<mozilla::dom::Element>,1> mChangedScopeStyleRoots;
+
   static nsIContent*        gKeyDownTarget;
 
   // Cached font inflation values. This is done to prevent changing of font
diff --git a/layout/base/nsPresShell.cpp b/layout/base/nsPresShell.cpp
index 427aecd9deb3..123354705322 100644
--- a/layout/base/nsPresShell.cpp
+++ b/layout/base/nsPresShell.cpp
@@ -33,7 +33,7 @@
 #include "mozilla/dom/Element.h"
 #include "nsIDocument.h"
 #include "nsIDOMXULDocument.h"
-#include "nsCSSStyleSheet.h" // XXX for UA sheet loading hack, can this go away please?
+#include "nsCSSStyleSheet.h"
 #include "nsIDOMCSSStyleSheet.h"  // for Pref-related rule management (bugs 22963,20760,31816)
 #include "nsAnimationManager.h"
 #include "nsINameSpaceManager.h"  // for Pref-related rule management (bugs 22963,20760,31816)
@@ -2419,7 +2419,7 @@ PresShell::EndUpdate(nsIDocument *aDocument, nsUpdateType aUpdateType)
 
   if (aUpdateType & UPDATE_STYLE) {
     mStyleSet->EndUpdate();
-    if (mStylesHaveChanged)
+    if (mStylesHaveChanged || !mChangedScopeStyleRoots.IsEmpty())
       ReconstructStyleData();
   }
 
@@ -4170,6 +4170,15 @@ PresShell::ReconstructFrames(void)
 void
 nsIPresShell::ReconstructStyleDataInternal()
 {
+  nsAutoTArray<nsRefPtr<mozilla::dom::Element>,1> scopeRoots;
+  mChangedScopeStyleRoots.SwapElements(scopeRoots);
+
+  if (mStylesHaveChanged) {
+    // If we need to restyle everything, no need to restyle individual
+    // scoped style roots.
+    scopeRoots.Clear();
+  }
+
   mStylesHaveChanged = false;
 
   if (mIsDestroying) {
@@ -4193,7 +4202,19 @@ nsIPresShell::ReconstructStyleDataInternal()
     return;
   }
   
-  mFrameConstructor->PostRestyleEvent(root, eRestyle_Subtree, NS_STYLE_HINT_NONE);
+  if (scopeRoots.IsEmpty()) {
+    // If scopeRoots is empty, we know that mStylesHaveChanged was true at
+    // the beginning of this function, and that we need to restyle the whole
+    // document.
+    mFrameConstructor->PostRestyleEvent(root, eRestyle_Subtree,
+                                        NS_STYLE_HINT_NONE);
+  } else {
+    for (uint32_t i = 0; i < scopeRoots.Length(); i++) {
+      Element* scopeRoot = scopeRoots[i];
+      mFrameConstructor->PostRestyleEvent(scopeRoot, eRestyle_Subtree,
+                                          NS_STYLE_HINT_NONE);
+    }
+  }
 }
 
 void
@@ -4202,6 +4223,24 @@ nsIPresShell::ReconstructStyleDataExternal()
   ReconstructStyleDataInternal();
 }
 
+void
+PresShell::RecordStyleSheetChange(nsIStyleSheet* aStyleSheet)
+{
+  if (mStylesHaveChanged)
+    return;
+
+  nsRefPtr<nsCSSStyleSheet> cssStyleSheet = do_QueryObject(aStyleSheet);
+  if (cssStyleSheet) {
+    Element* scopeElement = cssStyleSheet->GetScopeElement();
+    if (scopeElement) {
+      mChangedScopeStyleRoots.AppendElement(scopeElement);
+      return;
+    }
+  }
+
+  mStylesHaveChanged = true;
+}
+
 void
 PresShell::StyleSheetAdded(nsIDocument *aDocument,
                            nsIStyleSheet* aStyleSheet,
@@ -4211,7 +4250,7 @@ PresShell::StyleSheetAdded(nsIDocument *aDocument,
   NS_PRECONDITION(aStyleSheet, "Must have a style sheet!");
 
   if (aStyleSheet->IsApplicable() && aStyleSheet->HasRules()) {
-    mStylesHaveChanged = true;
+    RecordStyleSheetChange(aStyleSheet);
   }
 }
 
@@ -4224,7 +4263,7 @@ PresShell::StyleSheetRemoved(nsIDocument *aDocument,
   NS_PRECONDITION(aStyleSheet, "Must have a style sheet!");
 
   if (aStyleSheet->IsApplicable() && aStyleSheet->HasRules()) {
-    mStylesHaveChanged = true;
+    RecordStyleSheetChange(aStyleSheet);
   }
 }
 
@@ -4234,7 +4273,7 @@ PresShell::StyleSheetApplicableStateChanged(nsIDocument *aDocument,
                                             bool aApplicable)
 {
   if (aStyleSheet->HasRules()) {
-    mStylesHaveChanged = true;
+    RecordStyleSheetChange(aStyleSheet);
   }
 }
 
@@ -4244,7 +4283,7 @@ PresShell::StyleRuleChanged(nsIDocument *aDocument,
                             nsIStyleRule* aOldStyleRule,
                             nsIStyleRule* aNewStyleRule)
 {
-  mStylesHaveChanged = true;
+  RecordStyleSheetChange(aStyleSheet);
 }
 
 void
@@ -4252,7 +4291,7 @@ PresShell::StyleRuleAdded(nsIDocument *aDocument,
                           nsIStyleSheet* aStyleSheet,
                           nsIStyleRule* aStyleRule) 
 {
-  mStylesHaveChanged = true;
+  RecordStyleSheetChange(aStyleSheet);
 }
 
 void
@@ -4260,7 +4299,7 @@ PresShell::StyleRuleRemoved(nsIDocument *aDocument,
                             nsIStyleSheet* aStyleSheet,
                             nsIStyleRule* aStyleRule) 
 {
-  mStylesHaveChanged = true;
+  RecordStyleSheetChange(aStyleSheet);
 }
 
 nsIFrame*
diff --git a/layout/base/nsPresShell.h b/layout/base/nsPresShell.h
index bde4b2f3e9a8..2196ffae2209 100644
--- a/layout/base/nsPresShell.h
+++ b/layout/base/nsPresShell.h
@@ -440,6 +440,8 @@ protected:
   void ShowEventTargetDebug();
 #endif
 
+  void RecordStyleSheetChange(nsIStyleSheet* aStyleSheet);
+
     /**
     * methods that manage rules that are used to implement the associated preferences
     *  - initially created for bugs 31816, 20760, 22963
diff --git a/layout/generic/nsFlexContainerFrame.cpp b/layout/generic/nsFlexContainerFrame.cpp
index b15ac5b0fbf7..bbf101124b5e 100644
--- a/layout/generic/nsFlexContainerFrame.cpp
+++ b/layout/generic/nsFlexContainerFrame.cpp
@@ -2019,6 +2019,10 @@ nsFlexContainerFrame::Reflow(nsPresContext*           aPresContext,
   PR_LOG(GetFlexContainerLog(), PR_LOG_DEBUG,
          ("Reflow() for nsFlexContainerFrame %p\n", this));
 
+  if (IsFrameTreeTooDeep(aReflowState, aDesiredSize, aStatus)) {
+    return NS_OK;
+  }
+
   // We (and our children) can only depend on our ancestor's height if we have
   // a percent-height.  (There are actually other cases, too -- e.g. if our
   // parent is itself a vertical flex container and we're flexible -- but we'll
diff --git a/layout/generic/test/Makefile.in b/layout/generic/test/Makefile.in
index ee66fd130615..63e4b493a069 100644
--- a/layout/generic/test/Makefile.in
+++ b/layout/generic/test/Makefile.in
@@ -118,6 +118,7 @@ MOCHITEST_CHROME_FILES = \
   test_backspace_delete.xul \
   test_bug514732-2.xul \
   file_bug514732_window.xul \
+  test_selection_preventDefault.html \
   $(NULL)
 
 include $(topsrcdir)/config/rules.mk
diff --git a/layout/generic/test/test_selection_preventDefault.html b/layout/generic/test/test_selection_preventDefault.html
new file mode 100644
index 000000000000..032500b07d0b
--- /dev/null
+++ b/layout/generic/test/test_selection_preventDefault.html
@@ -0,0 +1,174 @@
+<!DOCTYPE>
+<html>
+<head>
+<title>selection preventDefault test</title>
+<script type="text/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
+<script type="text/javascript" src="chrome://mochikit/content/tests/SimpleTest/EventUtils.js"></script>
+<link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css" />
+
+<style type="text/css">
+  #fixedDiv1 {
+    position: fixed;
+    right: 0;
+    overflow: scroll;
+    width: 200px;
+    top: 0;
+  }
+  input {
+    font-size: 16px;
+    height: 16px;
+    width: 80px;
+    margin: 0;
+    padding: 0;
+  }
+</style>
+
+</head>
+<body>
+<input id="input" type="text" value="iiiiiiiii iiiiiiiii iiiiiiiii">
+<div id="fixedDiv1" class="testingDiv">
+dddddd dddddd dddddd
+</div>
+<pre id="test">
+<script class="testbody" type="text/javascript">
+
+var fixedDiv1 = document.getElementById("fixedDiv1");
+var input = document.getElementById("input");
+
+function test()
+{
+  function getSelectionForEditor(aEditorElement)
+  {
+    const nsIDOMNSEditableElement =
+      Components.interfaces.nsIDOMNSEditableElement;
+    return aEditorElement.QueryInterface(nsIDOMNSEditableElement).editor.selection;
+  }
+
+  function clear()
+  {
+    var sel = window.getSelection();
+    if (sel.rangeCount > 0)
+      sel.collapseToEnd();
+    sel = getSelectionForEditor(input);
+    if (sel.rangeCount > 0)
+      sel.collapseToEnd();
+  }
+
+  const kFalse = 0;
+  const kTrue  = 1;
+  const kToDo  = 2;
+
+  function check(aFixedDiv1ShouldBeSelected,
+                 aInputShouldBeSelected,
+                 aTestingDescription)
+  {
+    function checkCharacter(aSelectedText,
+                            aShouldBeIncludedCharacter,
+                            aSouldBeSelected,
+                            aElementName)
+    {
+      var boolvalue = aSouldBeSelected & kTrue;
+      var f = aSouldBeSelected & kToDo ? todo : ok;
+      var str = aSelectedText.replace('\n', '\\n');
+      if (boolvalue) {
+        f(aSelectedText.indexOf(aShouldBeIncludedCharacter) >= 0,
+          "The contents of " + aElementName +
+          " aren't selected (" + aTestingDescription +
+          "): Selected String: \"" + str + "\"");
+      } else {
+        f(aSelectedText.indexOf(aShouldBeIncludedCharacter) < 0,
+          "The contents of " + aElementName +
+          " are selected (" + aTestingDescription +
+          "): Selected String: \"" + str + "\"");
+      }
+    }
+
+    var sel = window.getSelection().toString();
+    checkCharacter(sel, "d", aFixedDiv1ShouldBeSelected, "fixedDiv1");
+
+    // input contents must not be included on the parent
+    // selection.
+    checkCharacter(sel, "i", false, "input (checking on parent)");
+
+    var selInput = getSelectionForEditor(input).toString();
+    checkCharacter(selInput, "i", aInputShouldBeSelected, "input");
+  }
+
+  function eventHandler(evt) {
+    evt.preventDefault();
+  }
+
+  // prevent default action on mousedown should prevent selection
+  fixedDiv1.addEventListener("mousedown", eventHandler);
+  synthesizeMouse(fixedDiv1, 30, 5, { type: "mousedown" });
+  synthesizeMouse(fixedDiv1, 40, 5, { type: "mousemove" });
+  synthesizeMouse(fixedDiv1, 40, 5, { type: "mouseup" });
+  check(kFalse, kFalse, "fixedDiv1-fixedDiv1-mousedown");
+  clear();
+
+  input.addEventListener("mousedown", eventHandler);
+  synthesizeMouse(input, 20, 5, { type: "mousedown" });
+  synthesizeMouse(input, 40, 5, { type: "mousemove" });
+  synthesizeMouse(input, 40, 5, { type: "mouseup" });
+  check(kFalse, kFalse, "input-input-mousedown");
+  clear();
+
+  // clean up mousedown listener
+  [fixedDiv1, input].forEach(function(element) {
+     element.removeEventListener("mousedown", eventHandler);
+  });
+
+  // prevent default action on mouseup should not affect the selection state
+  fixedDiv1.addEventListener("mouseup", eventHandler);
+  synthesizeMouse(fixedDiv1, 30, 5, { type: "mousedown" });
+  synthesizeMouse(fixedDiv1, 40, 5, { type: "mousemove" });
+  synthesizeMouse(fixedDiv1, 40, 5, { type: "mouseup" });
+  check(kTrue, kFalse, "fixedDiv1-fixedDiv1-mouseup");
+  clear();
+
+  input.addEventListener("mouseup", eventHandler);
+  synthesizeMouse(input, 20, 5, { type: "mousedown" });
+  synthesizeMouse(input, 40, 5, { type: "mousemove" });
+  synthesizeMouse(input, 40, 5, { type: "mouseup" });
+  check(kFalse, kTrue, "input-input-mouseup");
+  clear();
+
+  [fixedDiv1, input].forEach(function(element) {
+     element.removeEventListener("mouseup", eventHandler);
+  });
+
+  // touchmove event should not affect the selection state
+  synthesizeTouch(fixedDiv1, 30, 5, { type: "touchstart" });
+  synthesizeTouch(fixedDiv1, 40, 5, { type: "touchmove" });
+  check(kFalse, kFalse, "fixedDiv1-fixedDiv1-touchmove");
+  synthesizeTouch(fixedDiv1, 40, 5, { type: "touchend" });
+  clear();
+
+  synthesizeTouch(input, 20, 5, { type: "touchstart" });
+  synthesizeTouch(input, 40, 5, { type: "touchmove" });
+  check(kFalse, kFalse, "input-input-touchmove");
+  synthesizeTouch(input, 40, 5, { type: "touchend" });
+  clear();
+
+  fixedDiv1.addEventListener("touchmove", eventHandler);
+  synthesizeTouch(fixedDiv1, 30, 5, { type: "touchstart" });
+  synthesizeTouch(fixedDiv1, 40, 5, { type: "touchmove" });
+  check(kFalse, kFalse, "fixedDiv1-fixedDiv1-touchmove-preventDefault");
+  synthesizeTouch(fixedDiv1, 40, 5, { type: "touchend" });
+  clear();
+
+  input.addEventListener("touchmove", eventHandler);
+  synthesizeTouch(input, 20, 5, { type: "touchstart" });
+  synthesizeTouch(input, 40, 5, { type: "touchmove" });
+  check(kFalse, kFalse, "input-input-touchmove-preventDefault");
+  synthesizeTouch(input, 40, 5, { type: "touchend" });
+  clear();
+
+  SimpleTest.finish();
+}
+window.onload = function() { setTimeout(test, 0); };
+SimpleTest.waitForExplicitFinish();
+</script>
+</pre>
+</body>
+</html>
diff --git a/layout/ipc/RenderFrameParent.cpp b/layout/ipc/RenderFrameParent.cpp
index 305e7308aec5..1dcf3956e16c 100644
--- a/layout/ipc/RenderFrameParent.cpp
+++ b/layout/ipc/RenderFrameParent.cpp
@@ -725,6 +725,7 @@ RenderFrameParent::BuildLayer(nsDisplayListBuilder* aBuilder,
     ClearContainer(mContainer);
     mContainer->SetPreScale(1.0f, 1.0f);
     mContainer->SetPostScale(1.0f, 1.0f);
+    mContainer->SetInheritedScale(1.0f, 1.0f);
   }
 
   ContainerLayer* shadowRoot = GetRootLayer();
diff --git a/layout/mathml/nsMathMLContainerFrame.cpp b/layout/mathml/nsMathMLContainerFrame.cpp
index 6ada551e9cd9..8eaa7a2946ec 100644
--- a/layout/mathml/nsMathMLContainerFrame.cpp
+++ b/layout/mathml/nsMathMLContainerFrame.cpp
@@ -1522,7 +1522,7 @@ nsMathMLContainerFrame::TransmitAutomaticDataForMrowLikeElement()
 nsresult
 nsMathMLContainerFrame::ReportErrorToConsole(const char*       errorMsgId,
                                              const PRUnichar** aParams,
-                                             PRUint32          aParamCount)
+                                             uint32_t          aParamCount)
 {
   return nsContentUtils::ReportToConsole(nsIScriptError::errorFlag,
                                          "MathML", mContent->OwnerDoc(),
diff --git a/layout/mathml/nsMathMLContainerFrame.h b/layout/mathml/nsMathMLContainerFrame.h
index f9bb697492e0..b3d0b027eab3 100644
--- a/layout/mathml/nsMathMLContainerFrame.h
+++ b/layout/mathml/nsMathMLContainerFrame.h
@@ -267,7 +267,7 @@ public:
   nsresult
   ReportErrorToConsole(const char*       aErrorMsgId,
                        const PRUnichar** aParams = nullptr,
-                       PRUint32          aParamCount = 0);
+                       uint32_t          aParamCount = 0);
 
   // helper method to reflow a child frame. We are inline frames, and we don't
   // know our positions until reflow is finished. That's why we ask the
diff --git a/layout/printing/nsPrintEngine.cpp b/layout/printing/nsPrintEngine.cpp
index 02f7bbb10932..f3822bfd0d00 100644
--- a/layout/printing/nsPrintEngine.cpp
+++ b/layout/printing/nsPrintEngine.cpp
@@ -411,6 +411,7 @@ nsPrintEngine::CommonPrint(bool                    aIsPrintPreview,
                            nsIPrintSettings*       aPrintSettings,
                            nsIWebProgressListener* aWebProgressListener,
                            nsIDOMDocument* aDoc) {
+  nsRefPtr<nsPrintEngine> kungfuDeathGrip = this;
   nsresult rv = DoCommonPrint(aIsPrintPreview, aPrintSettings,
                               aWebProgressListener, aDoc);
   if (NS_FAILED(rv)) {
diff --git a/layout/reftests/reftest.list b/layout/reftests/reftest.list
index fa8472a446ce..7a9061fe752e 100644
--- a/layout/reftests/reftest.list
+++ b/layout/reftests/reftest.list
@@ -238,6 +238,9 @@ include position-dynamic-changes/reftest.list
 include printing/reftest.list
 include pagination/reftest.list
 
+# <style scoped>
+include scoped-style/reftest.list
+
 # scrolling
 include scrolling/reftest.list
 
diff --git a/layout/reftests/scoped-style/reftest.list b/layout/reftests/scoped-style/reftest.list
new file mode 100644
index 000000000000..9ca6548c26af
--- /dev/null
+++ b/layout/reftests/scoped-style/reftest.list
@@ -0,0 +1,51 @@
+== scoped-style-001.html scoped-style-001-ref.html
+== scoped-style-002.html scoped-style-002-ref.html
+== scoped-style-003.html scoped-style-003-ref.html
+== scoped-style-004.html scoped-style-004-ref.html
+== scoped-style-005.html scoped-style-005-ref.html
+== scoped-style-006.html scoped-style-006-ref.html
+== scoped-style-007.html scoped-style-007-ref.html
+== scoped-style-008.html scoped-style-008-ref.html
+== scoped-style-009.html scoped-style-009-ref.html
+== scoped-style-010.html scoped-style-010-ref.html
+== scoped-style-011.html scoped-style-011-ref.html
+== scoped-style-012.html scoped-style-012-ref.html
+== scoped-style-013.html scoped-style-013-ref.html
+== scoped-style-014.html scoped-style-014-ref.html
+== scoped-style-015.html scoped-style-015-ref.html
+== scoped-style-016.html scoped-style-016-ref.html
+== scoped-style-017.html scoped-style-017-ref.html
+== scoped-style-018.html scoped-style-018-ref.html
+== scoped-style-019.svg scoped-style-019-ref.svg
+== scoped-style-020.html scoped-style-020-ref.html
+== scoped-style-021.html scoped-style-021-ref.html
+== scoped-style-important-001.html scoped-style-important-001-ref.html
+== scoped-style-important-002.html scoped-style-important-002-ref.html
+== scoped-style-important-003.html scoped-style-important-003-ref.html
+== scoped-style-important-004.html scoped-style-important-004-ref.html
+== scoped-style-important-005.html scoped-style-important-005-ref.html
+== scoped-style-important-006.html scoped-style-important-006-ref.html
+== scoped-style-important-007.html scoped-style-important-007-ref.html
+== scoped-style-dynamic-001.html scoped-style-dynamic-001-ref.html
+== scoped-style-dynamic-002.html scoped-style-dynamic-002-ref.html
+== scoped-style-dynamic-003.html scoped-style-dynamic-003-ref.html
+== scoped-style-dynamic-004.html scoped-style-dynamic-004-ref.html
+== scoped-style-dynamic-005.html scoped-style-dynamic-005-ref.html
+== scoped-style-dynamic-006.html scoped-style-dynamic-006-ref.html
+== scoped-style-dynamic-007.html scoped-style-dynamic-007-ref.html
+== scoped-style-dynamic-008.html scoped-style-dynamic-008-ref.html
+== scoped-style-dynamic-009.html scoped-style-dynamic-009-ref.html
+== scoped-style-dynamic-010.html scoped-style-dynamic-010-ref.html
+== scoped-style-dynamic-011.html scoped-style-dynamic-011-ref.html
+== scoped-style-dynamic-012.svg scoped-style-dynamic-012-ref.svg
+== scoped-style-dynamic-013.svg scoped-style-dynamic-013-ref.svg
+== scoped-style-dynamic-014.svg scoped-style-dynamic-014-ref.svg
+== scoped-style-dynamic-015.svg scoped-style-dynamic-015-ref.svg
+== scoped-style-import.html scoped-style-import-ref.html
+== scoped-style-media.html scoped-style-media-ref.html
+== scoped-style-namespace.html scoped-style-namespace-ref.html
+== scoped-style-charset.html scoped-style-charset-ref.html
+== scoped-style-document.html scoped-style-document-ref.html
+HTTP(..) == scoped-style-font-face.html scoped-style-font-face-ref.html
+== scoped-style-keyframes.html scoped-style-keyframes-ref.html
+pref(layout.css.supports-rule.enabled,true) == scoped-style-supports.html scoped-style-supports-ref.html
diff --git a/layout/reftests/scoped-style/scoped-style-001-ref.html b/layout/reftests/scoped-style/scoped-style-001-ref.html
new file mode 100644
index 000000000000..3f763ef4beed
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-001-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p style="color: green">Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-001.html b/layout/reftests/scoped-style/scoped-style-001.html
new file mode 100644
index 000000000000..0ecefa21a681
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-001.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p>
+    <style scoped>
+      p { color: green }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-002-ref.html b/layout/reftests/scoped-style/scoped-style-002-ref.html
new file mode 100644
index 000000000000..9b30be20fbc5
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-002-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: blue">First</p>
+  <p style="color: green">Second</p>
+  <p style="color: blue">Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-002.html b/layout/reftests/scoped-style/scoped-style-002.html
new file mode 100644
index 000000000000..0acaa4dfb547
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-002.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<body>
+  <style>
+    p { color: blue }
+  </style>
+  <p>First</p>
+  <p>
+    <style scoped>
+      p { color: green }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-003-ref.html b/layout/reftests/scoped-style/scoped-style-003-ref.html
new file mode 100644
index 000000000000..9b30be20fbc5
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-003-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: blue">First</p>
+  <p style="color: green">Second</p>
+  <p style="color: blue">Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-003.html b/layout/reftests/scoped-style/scoped-style-003.html
new file mode 100644
index 000000000000..b1db050db91b
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-003.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p>
+    <style scoped>
+      p { color: green }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+  <style>
+    p { color: blue }
+  </style>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-004-ref.html b/layout/reftests/scoped-style/scoped-style-004-ref.html
new file mode 100644
index 000000000000..9b30be20fbc5
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-004-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: blue">First</p>
+  <p style="color: green">Second</p>
+  <p style="color: blue">Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-004.html b/layout/reftests/scoped-style/scoped-style-004.html
new file mode 100644
index 000000000000..61f05c18a2f2
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-004.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<body>
+  <style>
+    body p { color: blue }
+  </style>
+  <p>First</p>
+  <p>
+    <style scoped>
+      p { color: green }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-005-ref.html b/layout/reftests/scoped-style/scoped-style-005-ref.html
new file mode 100644
index 000000000000..9b30be20fbc5
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-005-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: blue">First</p>
+  <p style="color: green">Second</p>
+  <p style="color: blue">Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-005.html b/layout/reftests/scoped-style/scoped-style-005.html
new file mode 100644
index 000000000000..b555dfd3c35c
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-005.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p>
+    <style scoped>
+      p { color: green }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+  <style>
+    body p { color: blue }
+  </style>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-006-ref.html b/layout/reftests/scoped-style/scoped-style-006-ref.html
new file mode 100644
index 000000000000..9b30be20fbc5
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-006-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: blue">First</p>
+  <p style="color: green">Second</p>
+  <p style="color: blue">Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-006.html b/layout/reftests/scoped-style/scoped-style-006.html
new file mode 100644
index 000000000000..9789c510ebed
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-006.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<body>
+  <style>
+    p { color: blue }
+  </style>
+  <p>First</p>
+  <p id=a>
+    <style scoped>
+      #a { color: green }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-007-ref.html b/layout/reftests/scoped-style/scoped-style-007-ref.html
new file mode 100644
index 000000000000..9b30be20fbc5
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-007-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: blue">First</p>
+  <p style="color: green">Second</p>
+  <p style="color: blue">Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-007.html b/layout/reftests/scoped-style/scoped-style-007.html
new file mode 100644
index 000000000000..5f3185cea386
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-007.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p id=a>
+    <style scoped>
+      #a { color: green }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+  <style>
+    p { color: blue }
+  </style>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-008-ref.html b/layout/reftests/scoped-style/scoped-style-008-ref.html
new file mode 100644
index 000000000000..6e7f33bf4afa
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-008-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p>Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-008.html b/layout/reftests/scoped-style/scoped-style-008.html
new file mode 100644
index 000000000000..99fa4300e1fd
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-008.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p>
+    <style scoped>
+      body p { color: green }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-009-ref.html b/layout/reftests/scoped-style/scoped-style-009-ref.html
new file mode 100644
index 000000000000..6e7f33bf4afa
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-009-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p>Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-009.html b/layout/reftests/scoped-style/scoped-style-009.html
new file mode 100644
index 000000000000..48528c368e5a
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-009.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p>
+    <style scoped>
+      p + p { color: red }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-010-ref.html b/layout/reftests/scoped-style/scoped-style-010-ref.html
new file mode 100644
index 000000000000..4f6e81bc5350
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-010-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p style="color: green; text-decoration: underline">Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-010.html b/layout/reftests/scoped-style/scoped-style-010.html
new file mode 100644
index 000000000000..d996503457f8
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-010.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p>
+    <style scoped>
+      p { color: red }
+    </style>
+    <style scoped>
+      p { text-decoration: underline }
+    </style>
+    Second
+    <style scoped>
+      p { color: green }
+    </style>
+  </p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-011-ref.html b/layout/reftests/scoped-style/scoped-style-011-ref.html
new file mode 100644
index 000000000000..57f7c5377b6e
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-011-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p><div style="color: green">Second</div></p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-011.html b/layout/reftests/scoped-style/scoped-style-011.html
new file mode 100644
index 000000000000..778a9dbd784e
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-011.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <div>
+    <style scoped>
+      p { color: green }
+    </style>
+    <p>
+      Second
+    </p>
+  </div>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-012-ref.html b/layout/reftests/scoped-style/scoped-style-012-ref.html
new file mode 100644
index 000000000000..f4bc63d0943a
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-012-ref.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<body>
+  <div>First</div>
+  <div style="color: green">
+    Second
+    <div style="text-decoration: underline">Third</div>
+  </div>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-012.html b/layout/reftests/scoped-style/scoped-style-012.html
new file mode 100644
index 000000000000..5803e9dc49f0
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-012.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<body>
+  <div>First</div>
+  <div>
+    <style scoped>
+      div { color: green }
+    </style>
+    Second
+    <div>
+      <style scoped>
+        div { text-decoration: underline }
+      </style>
+      Third
+    </div>
+  </div>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-013-ref.html b/layout/reftests/scoped-style/scoped-style-013-ref.html
new file mode 100644
index 000000000000..7a2f780e07f4
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-013-ref.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<body>
+  <div>
+    <p>First</p>
+  </div>
+  <div>
+    <p style="color: green">Second</p>
+  </div>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-013.html b/layout/reftests/scoped-style/scoped-style-013.html
new file mode 100644
index 000000000000..7b9f97f51af5
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-013.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<body>
+  <div>
+    <p>First</p>
+  </div>
+  <div>
+    <style scoped>
+      div p { color: green }
+    </style>
+    <p>Second</p>
+  </div>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-014-ref.html b/layout/reftests/scoped-style/scoped-style-014-ref.html
new file mode 100644
index 000000000000..54cab8795a13
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-014-ref.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<body>
+  <div>
+    <p>First</p>
+  </div>
+  <blockquote>
+    <div>
+      <div>
+        <div>
+          <p style="color: green">Second</p>
+        </div>
+      </div>
+    </div>
+  </blockquote>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-014.html b/layout/reftests/scoped-style/scoped-style-014.html
new file mode 100644
index 000000000000..9c2fb88164e1
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-014.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<body>
+  <div>
+    <p>First</p>
+  </div>
+  <blockquote>
+    <style scoped>
+      blockquote p { color: green }
+    </style>
+    <div>
+      <div>
+        <div>
+          <p>Second</p>
+        </div>
+      </div>
+    </div>
+  </blockquote>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-015-ref.html b/layout/reftests/scoped-style/scoped-style-015-ref.html
new file mode 100644
index 000000000000..109d197982b6
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-015-ref.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <div>
+    <p style="color: green">Second</p>
+  </div>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-015.html b/layout/reftests/scoped-style/scoped-style-015.html
new file mode 100644
index 000000000000..8948f58f113a
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-015.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <div>
+    <style scoped>
+      p { color: red }
+    </style>
+    <p style="color: green">Second</p>
+  </div>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-016-ref.html b/layout/reftests/scoped-style/scoped-style-016-ref.html
new file mode 100644
index 000000000000..28f64c59a529
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-016-ref.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <div>
+    <p>Second</p>
+    <p style="color: green">Third</p>
+  </div>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-016.html b/layout/reftests/scoped-style/scoped-style-016.html
new file mode 100644
index 000000000000..658140c4e56d
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-016.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <div>
+    <style scoped>
+      p + p { color: green }
+    </style>
+    <p>Second</p>
+    <p>Third</p>
+  </div>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-017-ref.html b/layout/reftests/scoped-style/scoped-style-017-ref.html
new file mode 100644
index 000000000000..902861abb320
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-017-ref.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <div style="text-decoration: underline">
+    <p>Second</p>
+    <p>Third</p>
+  </div>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-017.html b/layout/reftests/scoped-style/scoped-style-017.html
new file mode 100644
index 000000000000..eb35174dbc8a
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-017.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <div>
+    <style scoped>
+      div { text-decoration: underline }
+    </style>
+    <p>
+      <style scoped>
+        div { color: red }
+      </style>
+      Second
+    </p>
+    <p>Third</p>
+  </div>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-018-ref.html b/layout/reftests/scoped-style/scoped-style-018-ref.html
new file mode 100644
index 000000000000..ea87d4a7abc5
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-018-ref.html
@@ -0,0 +1,8 @@
+<!DOCTYPE html>
+<body>
+  <div>
+    <div>
+      <p style="color: green">This should be green.</p>
+    </div>
+  </div>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-018.html b/layout/reftests/scoped-style/scoped-style-018.html
new file mode 100644
index 000000000000..f51d3b30c83c
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-018.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<body>
+  <div>
+    <div>
+      <p>This should be green.</p>
+      <style scoped>
+        p { color: green }
+      </style>
+    </div>
+    <style scoped>
+      p { color: red }
+    </style>
+  </div>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-019-ref.svg b/layout/reftests/scoped-style/scoped-style-019-ref.svg
new file mode 100644
index 000000000000..4f729794739e
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-019-ref.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <rect width="50" height="50"/>
+  <g>
+    <rect x="60" width="50" height="50" fill="blue"/>
+  </g>
+  <rect x="120" width="50" height="50"/>
+</svg>
diff --git a/layout/reftests/scoped-style/scoped-style-019.svg b/layout/reftests/scoped-style/scoped-style-019.svg
new file mode 100644
index 000000000000..161ebc7e79f3
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-019.svg
@@ -0,0 +1,10 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <rect width="50" height="50"/>
+  <g>
+    <style scoped="">
+      rect { fill: blue }
+    </style>
+    <rect x="60" width="50" height="50"/>
+  </g>
+  <rect x="120" width="50" height="50"/>
+</svg>
diff --git a/layout/reftests/scoped-style/scoped-style-020-ref.html b/layout/reftests/scoped-style/scoped-style-020-ref.html
new file mode 100644
index 000000000000..ef5bf0cb05bb
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-020-ref.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: green">Hello</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-020.html b/layout/reftests/scoped-style/scoped-style-020.html
new file mode 100644
index 000000000000..818e8da05796
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-020.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: green">
+    <style scoped>
+      p { color: red }
+    </style>
+    Hello
+  </p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-021-ref.html b/layout/reftests/scoped-style/scoped-style-021-ref.html
new file mode 100644
index 000000000000..ef5bf0cb05bb
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-021-ref.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: green">Hello</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-021.html b/layout/reftests/scoped-style/scoped-style-021.html
new file mode 100644
index 000000000000..406bd9e280bc
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-021.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<body>
+  <style scoped>
+    p { color: red }
+  </style>
+  <p style="color: green">Hello</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-charset-ref.html b/layout/reftests/scoped-style/scoped-style-charset-ref.html
new file mode 100644
index 000000000000..f1d8460a1b97
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-charset-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p style="color: blue">Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-charset.html b/layout/reftests/scoped-style/scoped-style-charset.html
new file mode 100644
index 000000000000..921148692c0d
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-charset.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p>
+    <style scoped>
+      @charset "UTF-16";
+      p { color: blue }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-document-ref.html b/layout/reftests/scoped-style/scoped-style-document-ref.html
new file mode 100644
index 000000000000..f1d8460a1b97
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-document-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p style="color: blue">Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-document.html b/layout/reftests/scoped-style/scoped-style-document.html
new file mode 100644
index 000000000000..cb02becd645e
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-document.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p>
+    <style scoped>
+      @-moz-document regexp("^.*scoped-style-document\\.html$") {
+        p { color: blue }
+      }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-001-ref.html b/layout/reftests/scoped-style/scoped-style-dynamic-001-ref.html
new file mode 100644
index 000000000000..3f763ef4beed
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-001-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p style="color: green">Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-001.html b/layout/reftests/scoped-style/scoped-style-dynamic-001.html
new file mode 100644
index 000000000000..08251ea81953
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-001.html
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<body onload="f()">
+  <p>First</p>
+  <p>Second</p>
+  <p>Third</p>
+  <script>
+    function f() {
+      var p = document.getElementsByTagName("p")[1];
+      var style = document.createElement("style");
+      style.setAttribute("scoped", "");
+      style.textContent = "p { color: green }";
+      p.appendChild(style);
+    }
+  </script>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-002-ref.html b/layout/reftests/scoped-style/scoped-style-dynamic-002-ref.html
new file mode 100644
index 000000000000..4f6e81bc5350
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-002-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p style="color: green; text-decoration: underline">Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-002.html b/layout/reftests/scoped-style/scoped-style-dynamic-002.html
new file mode 100644
index 000000000000..6d96511a134e
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-002.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<body onload="f()">
+  <p>First</p>
+  <p>
+    <style scoped>
+      p { text-decoration: underline }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+  <script>
+    function f() {
+      var p = document.getElementsByTagName("p")[1];
+      var style = document.createElement("style");
+      style.setAttribute("scoped", "");
+      style.textContent = "p { color: green }";
+      p.appendChild(style);
+    }
+  </script>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-003-ref.html b/layout/reftests/scoped-style/scoped-style-dynamic-003-ref.html
new file mode 100644
index 000000000000..3f763ef4beed
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-003-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p style="color: green">Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-003.html b/layout/reftests/scoped-style/scoped-style-dynamic-003.html
new file mode 100644
index 000000000000..048688cdf4b2
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-003.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<body onload="f()">
+  <p>First</p>
+  <p>
+    <style scoped>
+      p { color: green }
+    </style>
+    <style scoped>
+      p { text-decoration: underline }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+  <script>
+    function f() {
+      var style = document.getElementsByTagName("style")[1];
+      style.parentNode.removeChild(style);
+    }
+  </script>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-004-ref.html b/layout/reftests/scoped-style/scoped-style-dynamic-004-ref.html
new file mode 100644
index 000000000000..c0b77f52a3ba
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-004-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p style="color: green; background-color: yellow">Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-004.html b/layout/reftests/scoped-style/scoped-style-dynamic-004.html
new file mode 100644
index 000000000000..de11bf92813a
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-004.html
@@ -0,0 +1,20 @@
+<!DOCTYPE html>
+<body onload="f()">
+  <p>First</p>
+  <p>
+    <style scoped>
+      p { color: green }
+    </style>
+    <style scoped>
+      p { text-decoration: underline }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+  <script>
+    function f() {
+      var style = document.getElementsByTagName("style")[1];
+      style.textContent = "p { background-color: yellow }";
+    }
+  </script>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-005-ref.html b/layout/reftests/scoped-style/scoped-style-dynamic-005-ref.html
new file mode 100644
index 000000000000..9993e6f3125b
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-005-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: green">First</p>
+  <p style="color: green">Second</p>
+  <p style="color: green">Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-005.html b/layout/reftests/scoped-style/scoped-style-dynamic-005.html
new file mode 100644
index 000000000000..38e8b56d2fd3
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-005.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<body onload="f()">
+  <p>First</p>
+  <p>
+    <style scoped>
+      p { color: green }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+  <script>
+    function f() {
+      var style = document.getElementsByTagName("style")[0];
+      style.removeAttribute("scoped");
+    }
+  </script>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-006-ref.html b/layout/reftests/scoped-style/scoped-style-dynamic-006-ref.html
new file mode 100644
index 000000000000..3f763ef4beed
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-006-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p style="color: green">Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-006.html b/layout/reftests/scoped-style/scoped-style-dynamic-006.html
new file mode 100644
index 000000000000..8947b08aa830
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-006.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<body onload="f()">
+  <p>First</p>
+  <p>
+    <style>
+      p { color: green }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+  <script>
+    function f() {
+      var style = document.getElementsByTagName("style")[0];
+      style.setAttribute("scoped", "");
+    }
+  </script>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-007-ref.html b/layout/reftests/scoped-style/scoped-style-dynamic-007-ref.html
new file mode 100644
index 000000000000..52e5060f8bea
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-007-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <div></div>
+  <p>Second</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-007.html b/layout/reftests/scoped-style/scoped-style-dynamic-007.html
new file mode 100644
index 000000000000..6403cc5296e9
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-007.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<body onload="f()">
+  <p>First</p>
+  <div>
+    <style scoped>
+      p { color: green }
+    </style>
+    <p>Second</p>
+  </div>
+  <script>
+    function f() {
+      var p = document.getElementsByTagName("p")[1];
+      document.body.appendChild(p);
+    }
+  </script>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-008-ref.html b/layout/reftests/scoped-style/scoped-style-dynamic-008-ref.html
new file mode 100644
index 000000000000..9ce53f8911bd
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-008-ref.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<body>
+  <div>
+    <p style="color: green">First</p>
+  </div>
+  <p>Second</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-008.html b/layout/reftests/scoped-style/scoped-style-dynamic-008.html
new file mode 100644
index 000000000000..a19ebeb82885
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-008.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<body onload="f()">
+  <p>First</p>
+  <div>
+    <style scoped>
+      p { color: green }
+    </style>
+  </div>
+  <p>Second</p>
+  <script>
+    function f() {
+      var p = document.getElementsByTagName("p")[0];
+      var div = document.getElementsByTagName("div")[0];
+      div.appendChild(p);
+    }
+  </script>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-009-ref.html b/layout/reftests/scoped-style/scoped-style-dynamic-009-ref.html
new file mode 100644
index 000000000000..3f763ef4beed
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-009-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p style="color: green">Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-009.html b/layout/reftests/scoped-style/scoped-style-dynamic-009.html
new file mode 100644
index 000000000000..726cf672fc0d
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-009.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<body onload="f()">
+  <p>First</p>
+  <p>
+    <style>
+      p { color: green }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+  <script>
+    function f() {
+      var style = document.getElementsByTagName("style")[0];
+      style.scoped = true;
+    }
+  </script>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-010-ref.html b/layout/reftests/scoped-style/scoped-style-dynamic-010-ref.html
new file mode 100644
index 000000000000..9993e6f3125b
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-010-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: green">First</p>
+  <p style="color: green">Second</p>
+  <p style="color: green">Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-010.html b/layout/reftests/scoped-style/scoped-style-dynamic-010.html
new file mode 100644
index 000000000000..940cc717cb1a
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-010.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<body onload="f()">
+  <p>First</p>
+  <p>
+    <style scoped>
+      p { color: green }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+  <script>
+    function f() {
+      var style = document.getElementsByTagName("style")[0];
+      style.scoped = false;
+    }
+  </script>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-011-ref.html b/layout/reftests/scoped-style/scoped-style-dynamic-011-ref.html
new file mode 100644
index 000000000000..aa6dce1a4929
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-011-ref.html
@@ -0,0 +1,5 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p style="color: green">Second</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-011.html b/layout/reftests/scoped-style/scoped-style-dynamic-011.html
new file mode 100644
index 000000000000..e5223e19db75
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-011.html
@@ -0,0 +1,17 @@
+<!DOCTYPE html>
+<body onload="f()">
+  <p>
+    <style scoped>
+      p { color: green }
+    </style>
+    First
+  </p>
+  <p>Second</p>
+  <script>
+    function f() {
+      var style = document.getElementsByTagName("style")[0];
+      var p = document.getElementsByTagName("p")[1];
+      p.appendChild(style);
+    }
+  </script>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-012-ref.svg b/layout/reftests/scoped-style/scoped-style-dynamic-012-ref.svg
new file mode 100644
index 000000000000..5a1db3c2c09e
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-012-ref.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <rect width="50" height="50" fill="blue"/>
+  <g>
+    <rect x="60" width="50" height="50" fill="blue"/>
+  </g>
+  <rect x="120" width="50" height="50" fill="blue"/>
+</svg>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-012.svg b/layout/reftests/scoped-style/scoped-style-dynamic-012.svg
new file mode 100644
index 000000000000..1ecfb0e4ca93
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-012.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" onload="f()">
+  <rect width="50" height="50"/>
+  <g>
+    <style scoped="">
+      rect { fill: blue }
+    </style>
+    <rect x="60" width="50" height="50"/>
+  </g>
+  <rect x="120" width="50" height="50"/>
+  <script>
+    function f() {
+      document.getElementsByTagName("style")[0].removeAttribute("scoped");
+    }
+  </script>
+</svg>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-013-ref.svg b/layout/reftests/scoped-style/scoped-style-dynamic-013-ref.svg
new file mode 100644
index 000000000000..4f729794739e
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-013-ref.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <rect width="50" height="50"/>
+  <g>
+    <rect x="60" width="50" height="50" fill="blue"/>
+  </g>
+  <rect x="120" width="50" height="50"/>
+</svg>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-013.svg b/layout/reftests/scoped-style/scoped-style-dynamic-013.svg
new file mode 100644
index 000000000000..fc5f00111ad1
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-013.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" onload="f()">
+  <rect width="50" height="50"/>
+  <g>
+    <style>
+      rect { fill: blue }
+    </style>
+    <rect x="60" width="50" height="50"/>
+  </g>
+  <rect x="120" width="50" height="50"/>
+  <script>
+    function f() {
+      document.getElementsByTagName("style")[0].setAttribute("scoped", "");
+    }
+  </script>
+</svg>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-014-ref.svg b/layout/reftests/scoped-style/scoped-style-dynamic-014-ref.svg
new file mode 100644
index 000000000000..5a1db3c2c09e
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-014-ref.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <rect width="50" height="50" fill="blue"/>
+  <g>
+    <rect x="60" width="50" height="50" fill="blue"/>
+  </g>
+  <rect x="120" width="50" height="50" fill="blue"/>
+</svg>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-014.svg b/layout/reftests/scoped-style/scoped-style-dynamic-014.svg
new file mode 100644
index 000000000000..b19318ca4f6c
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-014.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" onload="f()">
+  <rect width="50" height="50"/>
+  <g>
+    <style scoped="">
+      rect { fill: blue }
+    </style>
+    <rect x="60" width="50" height="50"/>
+  </g>
+  <rect x="120" width="50" height="50"/>
+  <script>
+    function f() {
+      document.getElementsByTagName("style")[0].scoped = false;
+    }
+  </script>
+</svg>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-015-ref.svg b/layout/reftests/scoped-style/scoped-style-dynamic-015-ref.svg
new file mode 100644
index 000000000000..4f729794739e
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-015-ref.svg
@@ -0,0 +1,7 @@
+<svg xmlns="http://www.w3.org/2000/svg">
+  <rect width="50" height="50"/>
+  <g>
+    <rect x="60" width="50" height="50" fill="blue"/>
+  </g>
+  <rect x="120" width="50" height="50"/>
+</svg>
diff --git a/layout/reftests/scoped-style/scoped-style-dynamic-015.svg b/layout/reftests/scoped-style/scoped-style-dynamic-015.svg
new file mode 100644
index 000000000000..f6d2c7a57c46
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-dynamic-015.svg
@@ -0,0 +1,15 @@
+<svg xmlns="http://www.w3.org/2000/svg" onload="f()">
+  <rect width="50" height="50"/>
+  <g>
+    <style>
+      rect { fill: blue }
+    </style>
+    <rect x="60" width="50" height="50"/>
+  </g>
+  <rect x="120" width="50" height="50"/>
+  <script>
+    function f() {
+      document.getElementsByTagName("style")[0].scoped = true;
+    }
+  </script>
+</svg>
diff --git a/layout/reftests/scoped-style/scoped-style-font-face-ref.html b/layout/reftests/scoped-style/scoped-style-font-face-ref.html
new file mode 100644
index 000000000000..a2943b30a699
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-font-face-ref.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<body>
+  <style>
+    @font-face {
+      font-family: Ahem;
+      url: src(../fonts/Ahem.ttf);
+    }
+    #a { font-family: Ahem }
+  </style>
+  <p id=a>First</p>
+  <p style="color: blue">Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-font-face.html b/layout/reftests/scoped-style/scoped-style-font-face.html
new file mode 100644
index 000000000000..0fe34db057f6
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-font-face.html
@@ -0,0 +1,23 @@
+<!DOCTYPE html>
+<body>
+  <style>
+    @font-face {
+      font-family: Ahem;
+      url: src(../fonts/Ahem.ttf);
+    }
+    #a { font-family: Ahem }
+    #c { font-family: Ahem2 }
+  </style>
+  <p id=a>First</p>
+  <p>
+    <style scoped>
+      @font-face {
+        font-family: Ahem2;
+        url: src(../fonts/Ahem.ttf);
+      }
+      p { font-family: Ahem2; color: blue }
+    </style>
+    Second
+  </p>
+  <p id=c>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-import-ref.html b/layout/reftests/scoped-style/scoped-style-import-ref.html
new file mode 100644
index 000000000000..f1d8460a1b97
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-import-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p style="color: blue">Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-import.html b/layout/reftests/scoped-style/scoped-style-import.html
new file mode 100644
index 000000000000..414b4b157a9d
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-import.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p>
+    <style scoped>
+      @import url(scoped-style-imported.css);
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-important-001-ref.html b/layout/reftests/scoped-style/scoped-style-important-001-ref.html
new file mode 100644
index 000000000000..eadaf600dacc
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-important-001-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: blue">First</p>
+  <p style="color: blue">Second</p>
+  <p style="color: blue">Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-important-001.html b/layout/reftests/scoped-style/scoped-style-important-001.html
new file mode 100644
index 000000000000..1fd9f202e145
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-important-001.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p>
+    <style scoped>
+      p { color: red }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+  <style>
+    p { color: blue !important }
+  </style>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-important-002-ref.html b/layout/reftests/scoped-style/scoped-style-important-002-ref.html
new file mode 100644
index 000000000000..f1d8460a1b97
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-important-002-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p style="color: blue">Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-important-002.html b/layout/reftests/scoped-style/scoped-style-important-002.html
new file mode 100644
index 000000000000..3e2d1526e165
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-important-002.html
@@ -0,0 +1,11 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p style="color: red">
+    <style scoped>
+      p { color: blue !important }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-important-003-ref.html b/layout/reftests/scoped-style/scoped-style-important-003-ref.html
new file mode 100644
index 000000000000..9993e6f3125b
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-important-003-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: green">First</p>
+  <p style="color: green">Second</p>
+  <p style="color: green">Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-important-003.html b/layout/reftests/scoped-style/scoped-style-important-003.html
new file mode 100644
index 000000000000..410867d491e0
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-important-003.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p>
+    <style scoped>
+      p { color: red !important }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+  <style>
+    p { color: green !important }
+  </style>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-important-004-ref.html b/layout/reftests/scoped-style/scoped-style-important-004-ref.html
new file mode 100644
index 000000000000..9993e6f3125b
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-important-004-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: green">First</p>
+  <p style="color: green">Second</p>
+  <p style="color: green">Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-important-004.html b/layout/reftests/scoped-style/scoped-style-important-004.html
new file mode 100644
index 000000000000..546a8748c130
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-important-004.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p>
+    <style scoped>
+      p { color: red !important }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+  <style scoped>
+    p { color: green !important }
+  </style>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-important-005-ref.html b/layout/reftests/scoped-style/scoped-style-important-005-ref.html
new file mode 100644
index 000000000000..ef5bf0cb05bb
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-important-005-ref.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: green">Hello</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-important-005.html b/layout/reftests/scoped-style/scoped-style-important-005.html
new file mode 100644
index 000000000000..de5b3bd6f2e3
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-important-005.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<body>
+  <style scoped>
+    p { color: green !important }
+  </style>
+  <p style="color: red">Hello</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-important-006-ref.html b/layout/reftests/scoped-style/scoped-style-important-006-ref.html
new file mode 100644
index 000000000000..ef5bf0cb05bb
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-important-006-ref.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: green">Hello</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-important-006.html b/layout/reftests/scoped-style/scoped-style-important-006.html
new file mode 100644
index 000000000000..352bd6c9b7f1
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-important-006.html
@@ -0,0 +1,9 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: red">
+    <style scoped>
+      p { color: green !important }
+    </style>
+    Hello
+  </p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-important-007-ref.html b/layout/reftests/scoped-style/scoped-style-important-007-ref.html
new file mode 100644
index 000000000000..ef5bf0cb05bb
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-important-007-ref.html
@@ -0,0 +1,4 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: green">Hello</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-important-007.html b/layout/reftests/scoped-style/scoped-style-important-007.html
new file mode 100644
index 000000000000..fe69a6b638ca
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-important-007.html
@@ -0,0 +1,7 @@
+<!DOCTYPE html>
+<body>
+  <style scoped>
+    p { color: red !important }
+  </style>
+  <p style="color: green !important">Hello</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-imported.css b/layout/reftests/scoped-style/scoped-style-imported.css
new file mode 100644
index 000000000000..d964925b6a23
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-imported.css
@@ -0,0 +1 @@
+p { color: blue }
diff --git a/layout/reftests/scoped-style/scoped-style-keyframes-ref.html b/layout/reftests/scoped-style/scoped-style-keyframes-ref.html
new file mode 100644
index 000000000000..af12e6108b00
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-keyframes-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p style="color: green">First</p>
+  <p>Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-keyframes.html b/layout/reftests/scoped-style/scoped-style-keyframes.html
new file mode 100644
index 000000000000..18e9c6670501
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-keyframes.html
@@ -0,0 +1,28 @@
+<!DOCTYPE html>
+<body>
+  <style>
+    @keyframes a {
+      from { color: green }
+      to { color: green }
+    }
+    p { animation-duration: 1s; animation-fill-mode: both }
+    #a { animation-name: a }
+    #c { animation-name: b }
+  </style>
+  <p id=a>First</p>
+  <p>
+    <style scoped>
+      @keyframes a {
+        from { color: blue }
+        to { color: blue }
+      }
+      @keyframes b {
+        from { color: red }
+        to { color: red }
+      }
+      p { animation-name: b }
+    </style>
+    Second
+  </p>
+  <p id=c>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-media-ref.html b/layout/reftests/scoped-style/scoped-style-media-ref.html
new file mode 100644
index 000000000000..f1d8460a1b97
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-media-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p style="color: blue">Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-media.html b/layout/reftests/scoped-style/scoped-style-media.html
new file mode 100644
index 000000000000..6cebeb6da2e1
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-media.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p>
+    <style scoped>
+      @media not all {
+        p { text-decoration: underline }
+      }
+      @media all {
+        p { color: blue }
+      }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-namespace-ref.html b/layout/reftests/scoped-style/scoped-style-namespace-ref.html
new file mode 100644
index 000000000000..f1d8460a1b97
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-namespace-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p style="color: blue">Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-namespace.html b/layout/reftests/scoped-style/scoped-style-namespace.html
new file mode 100644
index 000000000000..714fea5e46ea
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-namespace.html
@@ -0,0 +1,12 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p>
+    <style scoped>
+      @namespace html url(http://www.w3.org/1999/xhtml);
+      html|p { color: blue }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-supports-ref.html b/layout/reftests/scoped-style/scoped-style-supports-ref.html
new file mode 100644
index 000000000000..f1d8460a1b97
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-supports-ref.html
@@ -0,0 +1,6 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p style="color: blue">Second</p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/scoped-style/scoped-style-supports.html b/layout/reftests/scoped-style/scoped-style-supports.html
new file mode 100644
index 000000000000..2e25340582d6
--- /dev/null
+++ b/layout/reftests/scoped-style/scoped-style-supports.html
@@ -0,0 +1,16 @@
+<!DOCTYPE html>
+<body>
+  <p>First</p>
+  <p>
+    <style scoped>
+      @supports (color: rainbow) {
+        p { text-decoration: underline }
+      }
+      @supports (color: blue) {
+        p { color: blue }
+      }
+    </style>
+    Second
+  </p>
+  <p>Third</p>
+</body>
diff --git a/layout/reftests/svg/conditions-08-ref.svg b/layout/reftests/svg/conditions-08-ref.svg
new file mode 100644
index 000000000000..50406bddb9c2
--- /dev/null
+++ b/layout/reftests/svg/conditions-08-ref.svg
@@ -0,0 +1,41 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+  <defs>
+    <clipPath id="c1">
+      <circle cx="50" cy="50" r="50"/>
+    </clipPath>
+    <mask id="m1">
+      <circle cx="50" cy="50" r="50" fill="#888"/>
+    </mask>
+    <filter id="f1">
+      <feColorMatrix type="hueRotate" values="60"/>
+    </filter>
+    <linearGradient id="l1">
+      <stop stop-color="red"/>
+      <stop offset="1" stop-color="yellow"/>
+    </linearGradient>
+    <pattern id="p1" viewBox="0 0 10 10" width="25%" height="25%">
+      <circle cx="5" cy="5" r="5" fill="red"/>
+    </pattern>
+  </defs>
+  <g fill="blue">
+    <g transform="translate(200,50)">
+      <rect width="100" height="100" clip-path="url(#c1)"/>
+    </g>
+    <g transform="translate(200,160)">
+      <rect width="100" height="100" mask="url(#m1)"/>
+    </g>
+    <g transform="translate(200,270)">
+      <rect width="100" height="100" filter="url(#f1)"/>
+    </g>
+    <g transform="translate(200,380)">
+      <rect width="100" height="100" fill="url(#l1)"/>
+    </g>
+    <g transform="translate(200,490)">
+      <rect width="100" height="100" fill="url(#p1)"/>
+    </g>
+  </g>
+</svg>
diff --git a/layout/reftests/svg/conditions-08.svg b/layout/reftests/svg/conditions-08.svg
new file mode 100644
index 000000000000..573533d00f83
--- /dev/null
+++ b/layout/reftests/svg/conditions-08.svg
@@ -0,0 +1,42 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg">
+  <title>Test that clipPath, mask, filter, gradients and patterns ignore failing conditionals</title>
+  <defs>
+    <clipPath id="c1" systemLanguage="xx">
+      <circle cx="50" cy="50" r="50"/>
+    </clipPath>
+    <mask id="m1" systemLanguage="xx">
+      <circle cx="50" cy="50" r="50" fill="#888"/>
+    </mask>
+    <filter id="f1" systemLanguage="xx">
+      <feColorMatrix type="hueRotate" values="60"/>
+    </filter>
+    <linearGradient id="l1" systemLanguage="xx">
+      <stop stop-color="red"/>
+      <stop offset="1" stop-color="yellow"/>
+    </linearGradient>
+    <pattern id="p1" viewBox="0 0 10 10" width="25%" height="25%" systemLanguage="xx">
+      <circle cx="5" cy="5" r="5" fill="red"/>
+    </pattern>
+  </defs>
+  <g fill="blue">
+    <g transform="translate(200,50)">
+      <rect width="100" height="100" clip-path="url(#c1)"/>
+    </g>
+    <g transform="translate(200,160)">
+      <rect width="100" height="100" mask="url(#m1)"/>
+    </g>
+    <g transform="translate(200,270)">
+      <rect width="100" height="100" filter="url(#f1)"/>
+    </g>
+    <g transform="translate(200,380)">
+      <rect width="100" height="100" fill="url(#l1)"/>
+    </g>
+    <g transform="translate(200,490)">
+      <rect width="100" height="100" fill="url(#p1)"/>
+    </g>
+  </g>
+</svg>
diff --git a/layout/reftests/svg/mask-basic-03.svg b/layout/reftests/svg/mask-basic-03.svg
new file mode 100644
index 000000000000..95727570c870
--- /dev/null
+++ b/layout/reftests/svg/mask-basic-03.svg
@@ -0,0 +1,19 @@
+<!--
+     Any copyright is dedicated to the Public Domain.
+     http://creativecommons.org/publicdomain/zero/1.0/
+-->
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
+
+  <!-- From https://bugzilla.mozilla.org/show_bug.cgi?id=779029 -->
+
+  <title>Test that the x/y/width/height attributes work on the mask element</title>
+
+  <mask id="mask" x="20%" y="20%" width="60%" height="60%">
+    <rect width="1000" height="1000" fill="white"/>
+  </mask>
+
+  <rect width="100%" height="100%" fill="lime"/>
+  <rect x="50" y="50" width="100" height="100" fill="red" mask="url(#mask)"/>
+  <rect x="70" y="70" width="60" height="60" fill="lime"/>
+
+</svg>
diff --git a/layout/reftests/svg/reftest.list b/layout/reftests/svg/reftest.list
index 035415e49fc4..ad99b3a0d06e 100644
--- a/layout/reftests/svg/reftest.list
+++ b/layout/reftests/svg/reftest.list
@@ -46,6 +46,7 @@ fuzzy-if(/^Windows\x20NT\x206\.1/.test(http.oscpu),1,2) == clipPath-and-shape-re
 == conditions-05.svg about:blank
 == conditions-06.svg pass.svg
 == conditions-07.svg pass.svg
+== conditions-08.svg conditions-08-ref.svg
 == currentColor-01.svg pass.svg
 == currentColor-02.svg pass.svg
 == currentColor-03.svg pass.svg
@@ -175,6 +176,7 @@ fuzzy-if(Android,9,980) == gradient-live-01d.svg gradient-live-01-ref.svg
 == marker-orientation-01.svg marker-orientation-01-ref.svg
 == mask-basic-01.svg pass.svg
 == mask-basic-02.svg mask-basic-02-ref.svg
+#== mask-basic-03.svg pass.svg
 == mask-extref-dataURI-01.svg pass.svg
 == mask-containing-masked-content-01.svg pass.svg
 == mask-transformed-01.svg mask-transformed-01-ref.svg
diff --git a/layout/reftests/text-svgglyphs/reftest.list b/layout/reftests/text-svgglyphs/reftest.list
index 71349ef27d4d..02d27a607666 100644
--- a/layout/reftests/text-svgglyphs/reftest.list
+++ b/layout/reftests/text-svgglyphs/reftest.list
@@ -6,6 +6,7 @@ pref(gfx.font_rendering.opentype_svg.enabled,true)    == svg-glyph-invalid.html
 pref(gfx.font_rendering.opentype_svg.enabled,true)    == svg-glyph-objectfill-solid.svg svg-glyph-objectfill-solid-ref.svg
 pref(gfx.font_rendering.opentype_svg.enabled,true)    == svg-glyph-objectstroke-solid.svg svg-glyph-objectstroke-solid-ref.svg
 pref(gfx.font_rendering.opentype_svg.enabled,true)    == svg-glyph-objectgradient.svg svg-glyph-objectgradient-ref.svg
+pref(gfx.font_rendering.opentype_svg.enabled,true)    == svg-glyph-objectgradient-zoom.svg svg-glyph-objectgradient-zoom-ref.svg
 pref(gfx.font_rendering.opentype_svg.enabled,true)    == svg-glyph-objectpattern.svg svg-glyph-objectpattern-ref.svg
 pref(gfx.font_rendering.opentype_svg.enabled,true)    == clip.html clip-ref.html
 pref(gfx.font_rendering.opentype_svg.enabled,true)    == svg-glyph-objectopacity.svg svg-glyph-objectopacity-ref.svg
diff --git a/layout/reftests/text-svgglyphs/svg-glyph-objectgradient-zoom-ref.svg b/layout/reftests/text-svgglyphs/svg-glyph-objectgradient-zoom-ref.svg
new file mode 100644
index 000000000000..95f3d1bb7049
--- /dev/null
+++ b/layout/reftests/text-svgglyphs/svg-glyph-objectgradient-zoom-ref.svg
@@ -0,0 +1,25 @@
+<svg xmlns="http://www.w3.org/2000/svg" reftest-zoom="0.5">
+
+  <defs>
+    <linearGradient id="grad" x1="0" y1="0" x2="800" y2="800" gradientUnits="userSpaceOnUse">
+      <stop stop-color="purple" offset="0%" />
+      <stop stop-color="lime" offset="100%" />
+    </linearGradient>
+    <radialGradient id="grad2" cx="250" cy="400" r="400" gradientUnits="userSpaceOnUse">
+      <stop stop-color="red" offset="0%" />
+      <stop stop-color="blue" offset="100%" />
+    </radialGradient>
+  </defs>
+
+  <rect x="20" y="20" width="160" height="160" stroke="none"
+    fill="url(#grad)" />
+
+  <rect x="310" y="10" width="180" height="180" fill="url(#grad)"
+    stroke="none" />
+
+  <rect x="20" y="320" width="160" height="160" fill="burlywood"
+    stroke="url(#grad2)" stroke-width="10" />
+
+  <rect x="310" y="310" width="180" height="180" fill="url(#grad2)"
+    stroke="url(#grad)" stroke-width="20" />
+</svg>
diff --git a/layout/reftests/text-svgglyphs/svg-glyph-objectgradient-zoom.svg b/layout/reftests/text-svgglyphs/svg-glyph-objectgradient-zoom.svg
new file mode 100644
index 000000000000..cebc4fb04cfb
--- /dev/null
+++ b/layout/reftests/text-svgglyphs/svg-glyph-objectgradient-zoom.svg
@@ -0,0 +1,35 @@
+<svg xmlns="http://www.w3.org/2000/svg" reftest-zoom="0.5">
+  <!--
+        Test that gradients are inherited from the outer object under zoom
+  -->
+
+  <style type="text/css"><![CDATA[
+    @font-face {
+      font-family: "Liberation";
+      src:url("resources/svg.woff") format("woff");
+    }
+
+    text {
+      font-family: "Liberation";
+      font-size: 200px;
+      stroke-width: 5;
+    }
+  ]]></style>
+
+  <defs>
+    <linearGradient id="grad" x1="0" y1="0" x2="800" y2="800" gradientUnits="userSpaceOnUse">
+      <stop stop-color="purple" offset="0%" />
+      <stop stop-color="lime" offset="100%" />
+    </linearGradient>
+    <radialGradient id="grad2" cx="250" cy="400" r="400" gradientUnits="userSpaceOnUse">
+      <stop stop-color="red" offset="0%" />
+      <stop stop-color="blue" offset="100%" />
+    </radialGradient>
+
+  </defs>
+
+  <text x="0" y="200" fill="url(#grad)" stroke="url(#grad2)">N</text>
+  <text x="300" y="200" fill="url(#grad)" stroke="url(#grad2)">O</text>
+  <text x="0" y="500" fill="url(#grad)" stroke="url(#grad2)">P</text>
+  <text x="300" y="500" fill="url(#grad)" stroke="url(#grad2)">Q</text>
+</svg>
diff --git a/layout/style/Loader.cpp b/layout/style/Loader.cpp
index 111c8c3b6700..70341a90df88 100644
--- a/layout/style/Loader.cpp
+++ b/layout/style/Loader.cpp
@@ -18,6 +18,7 @@
 
 #include "mozilla/Util.h"
 
+#include "mozilla/dom/Element.h"
 #include "mozilla/css/Loader.h"
 #include "nsIRunnable.h"
 #include "nsIUnicharStreamLoader.h"
@@ -70,6 +71,8 @@
 #include "mozilla/dom/EncodingUtils.h"
 using mozilla::dom::EncodingUtils;
 
+using namespace mozilla::dom;
+
 /**
  * OVERALL ARCHITECTURE
  *
@@ -1206,6 +1209,7 @@ Loader::PrepareSheet(nsCSSStyleSheet* aSheet,
                      const nsSubstring& aTitle,
                      const nsSubstring& aMediaString,
                      nsMediaList* aMediaList,
+                     Element* aScopeElement,
                      bool isAlternate)
 {
   NS_PRECONDITION(aSheet, "Must have a sheet!");
@@ -1232,6 +1236,7 @@ Loader::PrepareSheet(nsCSSStyleSheet* aSheet,
 
   aSheet->SetTitle(aTitle);
   aSheet->SetEnabled(! isAlternate);
+  aSheet->SetScopeElement(aScopeElement);
   return NS_OK;
 }
 
@@ -1794,6 +1799,7 @@ Loader::LoadInlineStyle(nsIContent* aElement,
                         uint32_t aLineNumber,
                         const nsAString& aTitle,
                         const nsAString& aMedia,
+                        Element* aScopeElement,
                         nsICSSLoaderObserver* aObserver,
                         bool* aCompleted,
                         bool* aIsAlternate)
@@ -1826,7 +1832,8 @@ Loader::LoadInlineStyle(nsIContent* aElement,
 
   LOG(("  Sheet is alternate: %d", *aIsAlternate));
 
-  rv = PrepareSheet(sheet, aTitle, aMedia, nullptr, *aIsAlternate);
+  rv = PrepareSheet(sheet, aTitle, aMedia, nullptr, aScopeElement,
+                    *aIsAlternate);
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = InsertSheetInDoc(sheet, aElement, mDocument);
@@ -1899,7 +1906,7 @@ Loader::LoadStyleLink(nsIContent* aElement,
 
   LOG(("  Sheet is alternate: %d", *aIsAlternate));
 
-  rv = PrepareSheet(sheet, aTitle, aMedia, nullptr, *aIsAlternate);
+  rv = PrepareSheet(sheet, aTitle, aMedia, nullptr, nullptr, *aIsAlternate);
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = InsertSheetInDoc(sheet, aElement, mDocument);
@@ -2057,7 +2064,7 @@ Loader::LoadChildSheet(nsCSSStyleSheet* aParentSheet,
                    false, empty, state, &isAlternate, getter_AddRefs(sheet));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  rv = PrepareSheet(sheet, empty, empty, aMedia, isAlternate);
+  rv = PrepareSheet(sheet, empty, empty, aMedia, nullptr, isAlternate);
   NS_ENSURE_SUCCESS(rv, rv);
 
   rv = InsertChildSheet(sheet, aParentSheet, aParentRule);
@@ -2168,7 +2175,7 @@ Loader::InternalLoadNonDocumentSheet(nsIURI* aURL,
                    empty, state, &isAlternate, getter_AddRefs(sheet));
   NS_ENSURE_SUCCESS(rv, rv);
 
-  rv = PrepareSheet(sheet, empty, empty, nullptr, isAlternate);
+  rv = PrepareSheet(sheet, empty, empty, nullptr, nullptr, isAlternate);
   NS_ENSURE_SUCCESS(rv, rv);
 
   if (state == eSheetComplete) {
diff --git a/layout/style/Loader.h b/layout/style/Loader.h
index fddfc145fa2f..034fed5e88f0 100644
--- a/layout/style/Loader.h
+++ b/layout/style/Loader.h
@@ -31,6 +31,12 @@ class nsMediaList;
 class nsIStyleSheetLinkingElement;
 class nsCycleCollectionTraversalCallback;
 
+namespace mozilla {
+namespace dom {
+class Element;
+}
+}
+
 namespace mozilla {
 
 class URIPrincipalAndCORSModeHashKey : public nsURIHashKey
@@ -160,6 +166,7 @@ public:
                            uint32_t aLineNumber,
                            const nsAString& aTitle,
                            const nsAString& aMedia,
+                           mozilla::dom::Element* aScopeElement,
                            nsICSSLoaderObserver* aObserver,
                            bool* aCompleted,
                            bool* aIsAlternate);
@@ -395,6 +402,7 @@ private:
                         const nsAString& aTitle,
                         const nsAString& aMediaString,
                         nsMediaList* aMediaList,
+                        mozilla::dom::Element* aScopeElement,
                         bool isAlternate);
 
   nsresult InsertSheetInDoc(nsCSSStyleSheet* aSheet,
diff --git a/layout/style/nsCSSParser.cpp b/layout/style/nsCSSParser.cpp
index a08f5f21e7eb..2cd09e783ec7 100644
--- a/layout/style/nsCSSParser.cpp
+++ b/layout/style/nsCSSParser.cpp
@@ -579,7 +579,7 @@ protected:
   bool ParseCursor();
   bool ParseFont();
   bool ParseFontWeight(nsCSSValue& aValue);
-  bool ParseOneFamily(nsAString& aValue);
+  bool ParseOneFamily(nsAString& aFamily, bool& aOneKeyword);
   bool ParseFamily(nsCSSValue& aValue);
   bool ParseFontFeatureSettings(nsCSSValue& aValue);
   bool ParseFontSrc(nsCSSValue& aValue);
@@ -8356,20 +8356,23 @@ CSSParserImpl::ParseFontWeight(nsCSSValue& aValue)
 }
 
 bool
-CSSParserImpl::ParseOneFamily(nsAString& aFamily)
+CSSParserImpl::ParseOneFamily(nsAString& aFamily, bool& aOneKeyword)
 {
   if (!GetToken(true))
     return false;
 
   nsCSSToken* tk = &mToken;
 
+  aOneKeyword = false;
   if (eCSSToken_Ident == tk->mType) {
+    aOneKeyword = true;
     aFamily.Append(tk->mIdent);
     for (;;) {
       if (!GetToken(false))
         break;
 
       if (eCSSToken_Ident == tk->mType) {
+        aOneKeyword = false;
         aFamily.Append(tk->mIdent);
       } else if (eCSSToken_WhiteSpace == tk->mType) {
         // Lookahead one token and drop whitespace if we are ending the
@@ -8401,444 +8404,28 @@ CSSParserImpl::ParseOneFamily(nsAString& aFamily)
   }
 }
 
-///////////////////////////////////////////////////////
-// transform Parsing Implementation
-
-/* Reads a function list of arguments.  Do not call this function
- * directly; it's mean to be caled from ParseFunction.
- */
-bool
-CSSParserImpl::ParseFunctionInternals(const int32_t aVariantMask[],
-                                      uint16_t aMinElems,
-                                      uint16_t aMaxElems,
-                                      InfallibleTArray<nsCSSValue> &aOutput)
-{
-  for (uint16_t index = 0; index < aMaxElems; ++index) {
-    nsCSSValue newValue;
-    if (!ParseVariant(newValue, aVariantMask[index], nullptr))
-      return false;
-
-    aOutput.AppendElement(newValue);
-
-    // See whether to continue or whether to look for end of function.
-    if (!ExpectSymbol(',', true)) {
-      // We need to read the closing parenthesis, and also must take care
-      // that we haven't read too few symbols.
-      return ExpectSymbol(')', true) && (index + 1) >= aMinElems;
-    }
-  }
-
-  // If we're here, we finished looping without hitting the end, so we read too
-  // many elements.
-  return false;
-}
-
-/* Parses a function [ input of the form (a [, b]*) ] and stores it
- * as an nsCSSValue that holds a function of the form
- * function-name arg1 arg2 ... argN
- *
- * On error, the return value is false.
- *
- * @param aFunction The name of the function that we're reading.
- * @param aAllowedTypes An array of values corresponding to the legal
- *        types for each element in the function.  The zeroth element in the
- *        array corresponds to the first function parameter, etc.  The length
- *        of this array _must_ be greater than or equal to aMaxElems or the
- *        behavior is undefined.
- * @param aMinElems Minimum number of elements to read.  Reading fewer than
- *        this many elements will result in the function failing.
- * @param aMaxElems Maximum number of elements to read.  Reading more than
- *        this many elements will result in the function failing.
- * @param aValue (out) The value that was parsed.
- */
-bool
-CSSParserImpl::ParseFunction(const nsString &aFunction,
-                             const int32_t aAllowedTypes[],
-                             uint16_t aMinElems, uint16_t aMaxElems,
-                             nsCSSValue &aValue)
-{
-  typedef InfallibleTArray<nsCSSValue>::size_type arrlen_t;
-
-  /* 2^16 - 2, so that if we have 2^16 - 2 transforms, we have 2^16 - 1
-   * elements stored in the the nsCSSValue::Array.
-   */
-  static const arrlen_t MAX_ALLOWED_ELEMS = 0xFFFE;
-
-  /* Make a copy of the function name, since the reference is _probably_ to
-   * mToken.mIdent, which is going to get overwritten during the course of this
-   * function.
-   */
-  nsString functionName(aFunction);
-
-  /* Read in a list of values as an array, failing if we can't or if
-   * it's out of bounds.
-   */
-  InfallibleTArray<nsCSSValue> foundValues;
-  if (!ParseFunctionInternals(aAllowedTypes, aMinElems, aMaxElems,
-                              foundValues))
-    return false;
-
-  /* Now, convert this array into an nsCSSValue::Array object.
-   * We'll need N + 1 spots, one for the function name and the rest for the
-   * arguments.  In case the user has given us more than 2^16 - 2 arguments,
-   * we'll truncate them at 2^16 - 2 arguments.
-   */
-  uint16_t numElements = (foundValues.Length() <= MAX_ALLOWED_ELEMS ?
-                          foundValues.Length() + 1 : MAX_ALLOWED_ELEMS);
-  nsRefPtr<nsCSSValue::Array> convertedArray =
-    nsCSSValue::Array::Create(numElements);
-
-  /* Copy things over. */
-  convertedArray->Item(0).SetStringValue(functionName, eCSSUnit_Ident);
-  for (uint16_t index = 0; index + 1 < numElements; ++index)
-    convertedArray->Item(index + 1) = foundValues[static_cast<arrlen_t>(index)];
-
-  /* Fill in the outparam value with the array. */
-  aValue.SetArrayValue(convertedArray, eCSSUnit_Function);
-
-  /* Return it! */
-  return true;
-}
-
-/**
- * Given a token, determines the minimum and maximum number of function
- * parameters to read, along with the mask that should be used to read
- * those function parameters.  If the token isn't a transform function,
- * returns an error.
- *
- * @param aToken The token identifying the function.
- * @param aMinElems [out] The minimum number of elements to read.
- * @param aMaxElems [out] The maximum number of elements to read
- * @param aVariantMask [out] The variant mask to use during parsing
- * @return Whether the information was loaded successfully.
- */
-static bool GetFunctionParseInformation(nsCSSKeyword aToken,
-                                        bool aIsPrefixed,
-                                        uint16_t &aMinElems,
-                                        uint16_t &aMaxElems,
-                                        const int32_t *& aVariantMask,
-                                        bool &aIs3D)
-{
-/* These types represent the common variant masks that will be used to
-   * parse out the individual functions.  The order in the enumeration
-   * must match the order in which the masks are declared.
-   */
-  enum { eLengthPercentCalc,
-         eLengthCalc,
-         eTwoLengthPercentCalcs,
-         eTwoLengthPercentCalcsOneLengthCalc,
-         eAngle,
-         eTwoAngles,
-         eNumber,
-         ePositiveLength,
-         eTwoNumbers,
-         eThreeNumbers,
-         eThreeNumbersOneAngle,
-         eMatrix,
-         eMatrixPrefixed,
-         eMatrix3d,
-         eMatrix3dPrefixed,
-         eNumVariantMasks };
-  static const int32_t kMaxElemsPerFunction = 16;
-  static const int32_t kVariantMasks[eNumVariantMasks][kMaxElemsPerFunction] = {
-    {VARIANT_LPCALC},
-    {VARIANT_LENGTH|VARIANT_CALC},
-    {VARIANT_LPCALC, VARIANT_LPCALC},
-    {VARIANT_LPCALC, VARIANT_LPCALC, VARIANT_LENGTH|VARIANT_CALC},
-    {VARIANT_ANGLE_OR_ZERO},
-    {VARIANT_ANGLE_OR_ZERO, VARIANT_ANGLE_OR_ZERO},
-    {VARIANT_NUMBER},
-    {VARIANT_LENGTH|VARIANT_POSITIVE_DIMENSION},
-    {VARIANT_NUMBER, VARIANT_NUMBER},
-    {VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER},
-    {VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_ANGLE_OR_ZERO},
-    {VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER,
-     VARIANT_NUMBER, VARIANT_NUMBER},
-    {VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER,
-     VARIANT_LPNCALC, VARIANT_LPNCALC},
-    {VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER,
-     VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER,
-     VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER,
-     VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER},
-    {VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER,
-     VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER,
-     VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER,
-     VARIANT_LPNCALC, VARIANT_LPNCALC, VARIANT_LNCALC, VARIANT_NUMBER}};
-
-#ifdef DEBUG
-  static const uint8_t kVariantMaskLengths[eNumVariantMasks] =
-    {1, 1, 2, 3, 1, 2, 1, 1, 2, 3, 4, 6, 6, 16, 16};
-#endif
-
-  int32_t variantIndex = eNumVariantMasks;
-
-  aIs3D = false;
-
-  switch (aToken) {
-  case eCSSKeyword_translatex:
-  case eCSSKeyword_translatey:
-    /* Exactly one length or percent. */
-    variantIndex = eLengthPercentCalc;
-    aMinElems = 1U;
-    aMaxElems = 1U;
-    break;
-  case eCSSKeyword_translatez:
-    /* Exactly one length */
-    variantIndex = eLengthCalc;
-    aMinElems = 1U;
-    aMaxElems = 1U;
-    aIs3D = true;
-    break;
-  case eCSSKeyword_translate3d:
-    /* Exactly two lengthds or percents and a number */
-    variantIndex = eTwoLengthPercentCalcsOneLengthCalc;
-    aMinElems = 3U;
-    aMaxElems = 3U;
-    aIs3D = true;
-    break;
-  case eCSSKeyword_scalez:
-    aIs3D = true;
-  case eCSSKeyword_scalex:
-  case eCSSKeyword_scaley:
-    /* Exactly one scale factor. */
-    variantIndex = eNumber;
-    aMinElems = 1U;
-    aMaxElems = 1U;
-    break;
-  case eCSSKeyword_scale3d:
-    /* Exactly three scale factors. */
-    variantIndex = eThreeNumbers;
-    aMinElems = 3U;
-    aMaxElems = 3U;
-    aIs3D = true;
-    break;
-  case eCSSKeyword_rotatex:
-  case eCSSKeyword_rotatey:
-    aIs3D = true;
-  case eCSSKeyword_rotate:
-  case eCSSKeyword_rotatez:
-    /* Exactly one angle. */
-    variantIndex = eAngle;
-    aMinElems = 1U;
-    aMaxElems = 1U;
-    break;
-  case eCSSKeyword_rotate3d:
-    variantIndex = eThreeNumbersOneAngle;
-    aMinElems = 4U;
-    aMaxElems = 4U;
-    aIs3D = true;
-    break;
-  case eCSSKeyword_translate:
-    /* One or two lengths or percents. */
-    variantIndex = eTwoLengthPercentCalcs;
-    aMinElems = 1U;
-    aMaxElems = 2U;
-    break;
-  case eCSSKeyword_skew:
-    /* Exactly one or two angles. */
-    variantIndex = eTwoAngles;
-    aMinElems = 1U;
-    aMaxElems = 2U;
-    break;
-  case eCSSKeyword_scale:
-    /* One or two scale factors. */
-    variantIndex = eTwoNumbers;
-    aMinElems = 1U;
-    aMaxElems = 2U;
-    break;
-  case eCSSKeyword_skewx:
-    /* Exactly one angle. */
-    variantIndex = eAngle;
-    aMinElems = 1U;
-    aMaxElems = 1U;
-    break;
-  case eCSSKeyword_skewy:
-    /* Exactly one angle. */
-    variantIndex = eAngle;
-    aMinElems = 1U;
-    aMaxElems = 1U;
-    break;
-  case eCSSKeyword_matrix:
-    /* Six values, all numbers. */
-    variantIndex = aIsPrefixed ? eMatrixPrefixed : eMatrix;
-    aMinElems = 6U;
-    aMaxElems = 6U;
-    break;
-  case eCSSKeyword_matrix3d:
-    /* 16 matrix values, all numbers */
-    variantIndex = aIsPrefixed ? eMatrix3dPrefixed : eMatrix3d;
-    aMinElems = 16U;
-    aMaxElems = 16U;
-    aIs3D = true;
-    break;
-  case eCSSKeyword_perspective:
-    /* Exactly one scale number. */
-    variantIndex = ePositiveLength;
-    aMinElems = 1U;
-    aMaxElems = 1U;
-    aIs3D = true;
-    break;
-  default:
-    /* Oh dear, we didn't match.  Report an error. */
-    return false;
-  }
-
-  NS_ASSERTION(aMinElems > 0, "Didn't update minimum elements!");
-  NS_ASSERTION(aMaxElems > 0, "Didn't update maximum elements!");
-  NS_ASSERTION(aMinElems <= aMaxElems, "aMinElems > aMaxElems!");
-  NS_ASSERTION(variantIndex >= 0, "Invalid variant mask!");
-  NS_ASSERTION(variantIndex < eNumVariantMasks, "Invalid variant mask!");
-#ifdef DEBUG
-  NS_ASSERTION(aMaxElems <= kVariantMaskLengths[variantIndex],
-               "Invalid aMaxElems for this variant mask.");
-#endif
-
-  // Convert the index into a mask.
-  aVariantMask = kVariantMasks[variantIndex];
-
-  return true;
-}
-
-/* Reads a single transform function from the tokenizer stream, reporting an
- * error if something goes wrong.
- */
-bool
-CSSParserImpl::ParseSingleTransform(bool aIsPrefixed,
-                                    nsCSSValue& aValue, bool& aIs3D)
-{
-  if (!GetToken(true))
-    return false;
-
-  if (mToken.mType != eCSSToken_Function) {
-    UngetToken();
-    return false;
-  }
-
-  const int32_t* variantMask;
-  uint16_t minElems, maxElems;
-  nsCSSKeyword keyword = nsCSSKeywords::LookupKeyword(mToken.mIdent);
-
-  if (!GetFunctionParseInformation(keyword, aIsPrefixed,
-                                   minElems, maxElems, variantMask, aIs3D))
-    return false;
-
-  // Bug 721136: Normalize the identifier to lowercase, except that things
-  // like scaleX should have the last character capitalized.  This matches
-  // what other browsers do.
-  nsContentUtils::ASCIIToLower(mToken.mIdent);
-  switch (keyword) {
-    case eCSSKeyword_rotatex:
-    case eCSSKeyword_scalex:
-    case eCSSKeyword_skewx:
-    case eCSSKeyword_translatex:
-      mToken.mIdent.Replace(mToken.mIdent.Length() - 1, 1, PRUnichar('X'));
-      break;
-
-    case eCSSKeyword_rotatey:
-    case eCSSKeyword_scaley:
-    case eCSSKeyword_skewy:
-    case eCSSKeyword_translatey:
-      mToken.mIdent.Replace(mToken.mIdent.Length() - 1, 1, PRUnichar('Y'));
-      break;
-
-    case eCSSKeyword_rotatez:
-    case eCSSKeyword_scalez:
-    case eCSSKeyword_translatez:
-      mToken.mIdent.Replace(mToken.mIdent.Length() - 1, 1, PRUnichar('Z'));
-      break;
-
-    default:
-      break;
-  }
-
-  return ParseFunction(mToken.mIdent, variantMask, minElems, maxElems, aValue);
-}
-
-/* Parses a transform property list by continuously reading in properties
- * and constructing a matrix from it.
- */
-bool CSSParserImpl::ParseTransform(bool aIsPrefixed)
-{
-  nsCSSValue value;
-  if (ParseVariant(value, VARIANT_INHERIT | VARIANT_NONE, nullptr)) {
-    // 'inherit', 'initial', and 'none' must be alone
-    if (!ExpectEndProperty()) {
-      return false;
-    }
-  } else {
-    nsCSSValueList* cur = value.SetListValue();
-    for (;;) {
-      bool is3D;
-      if (!ParseSingleTransform(aIsPrefixed, cur->mValue, is3D)) {
-        return false;
-      }
-      if (is3D && !nsLayoutUtils::Are3DTransformsEnabled()) {
-        return false;
-      }
-      if (CheckEndProperty()) {
-        break;
-      }
-      cur->mNext = new nsCSSValueList;
-      cur = cur->mNext;
-    }
-  }
-  AppendValue(eCSSProperty_transform, value);
-  return true;
-}
-
-bool CSSParserImpl::ParseTransformOrigin(bool aPerspective)
-{
-  nsCSSValuePair position;
-  if (!ParseBoxPositionValues(position, true))
-    return false;
-
-  nsCSSProperty prop = eCSSProperty_transform_origin;
-  if (aPerspective) {
-    if (!ExpectEndProperty()) {
-      return false;
-    }
-    prop = eCSSProperty_perspective_origin;
-  }
-
-  // Unlike many other uses of pairs, this position should always be stored
-  // as a pair, even if the values are the same, so it always serializes as
-  // a pair, and to keep the computation code simple.
-  if (position.mXValue.GetUnit() == eCSSUnit_Inherit ||
-      position.mXValue.GetUnit() == eCSSUnit_Initial) {
-    NS_ABORT_IF_FALSE(position.mXValue == position.mYValue,
-                      "inherit/initial only half?");
-    AppendValue(prop, position.mXValue);
-  } else {
-    nsCSSValue value;
-    if (aPerspective) {
-      value.SetPairValue(position.mXValue, position.mYValue);
-    } else {
-      nsCSSValue depth;
-      if (!nsLayoutUtils::Are3DTransformsEnabled() ||
-          // only try parsing if 3-D transforms are enabled
-          !ParseVariant(depth, VARIANT_LENGTH | VARIANT_CALC, nullptr)) {
-        depth.SetFloatValue(0.0f, eCSSUnit_Pixel);
-      }
-      value.SetTripletValue(position.mXValue, position.mYValue, depth);
-    }
-
-    AppendValue(prop, value);
-  }
-  return true;
-}
-
 bool
 CSSParserImpl::ParseFamily(nsCSSValue& aValue)
 {
-  if (!GetToken(true))
+  nsAutoString family;
+  bool single;
+
+  // keywords only have meaning in the first position
+  if (!ParseOneFamily(family, single))
     return false;
 
-  if (eCSSToken_Ident == mToken.mType) {
-    nsCSSKeyword keyword = nsCSSKeywords::LookupKeyword(mToken.mIdent);
+  // check for keywords, but only when keywords appear by themselves
+  // i.e. not in compounds such as font-family: default blah;
+  if (single) {
+    nsCSSKeyword keyword = nsCSSKeywords::LookupKeyword(family);
     if (keyword == eCSSKeyword_inherit) {
       aValue.SetInheritValue();
       return true;
     }
+    // 605231 - don't parse unquoted 'default' reserved keyword
+    if (keyword == eCSSKeyword_default) {
+      return false;
+    }
     if (keyword == eCSSKeyword__moz_initial || keyword == eCSSKeyword_initial) {
       aValue.SetInitialValue();
       return true;
@@ -8850,17 +8437,33 @@ CSSParserImpl::ParseFamily(nsCSSValue& aValue)
     }
   }
 
-  UngetToken();
-
-  nsAutoString family;
   for (;;) {
-    if (!ParseOneFamily(family))
-      return false;
-
     if (!ExpectSymbol(',', true))
       break;
 
     family.Append(PRUnichar(','));
+
+    nsAutoString nextFamily;
+    if (!ParseOneFamily(nextFamily, single))
+      return false;
+
+    // at this point unquoted keywords are not allowed
+    // as font family names but can appear within names
+    if (single) {
+      nsCSSKeyword keyword = nsCSSKeywords::LookupKeyword(nextFamily);
+      switch (keyword) {
+        case eCSSKeyword_inherit:
+        case eCSSKeyword_initial:
+        case eCSSKeyword_default:
+        case eCSSKeyword__moz_initial:
+        case eCSSKeyword__moz_use_system_font:
+          return false;
+        default:
+          break;
+      }
+    }
+
+    family.Append(nextFamily);
   }
 
   if (family.IsEmpty()) {
@@ -8899,7 +8502,8 @@ CSSParserImpl::ParseFontSrc(nsCSSValue& aValue)
       // <family-name>, possibly surrounded by whitespace.
 
       nsAutoString family;
-      if (!ParseOneFamily(family)) {
+      bool single;
+      if (!ParseOneFamily(family, single)) {
         SkipUntil(')');
         return false;
       }
@@ -9492,7 +9096,433 @@ CSSParserImpl::ParseTextOverflow(nsCSSValue& aValue)
   }
   return true;
 }
- 
+
+///////////////////////////////////////////////////////
+// transform Parsing Implementation
+
+/* Reads a function list of arguments.  Do not call this function
+ * directly; it's mean to be caled from ParseFunction.
+ */
+bool
+CSSParserImpl::ParseFunctionInternals(const int32_t aVariantMask[],
+                                      uint16_t aMinElems,
+                                      uint16_t aMaxElems,
+                                      InfallibleTArray<nsCSSValue> &aOutput)
+{
+  for (uint16_t index = 0; index < aMaxElems; ++index) {
+    nsCSSValue newValue;
+    if (!ParseVariant(newValue, aVariantMask[index], nullptr))
+      return false;
+
+    aOutput.AppendElement(newValue);
+
+    // See whether to continue or whether to look for end of function.
+    if (!ExpectSymbol(',', true)) {
+      // We need to read the closing parenthesis, and also must take care
+      // that we haven't read too few symbols.
+      return ExpectSymbol(')', true) && (index + 1) >= aMinElems;
+    }
+  }
+
+  // If we're here, we finished looping without hitting the end, so we read too
+  // many elements.
+  return false;
+}
+
+/* Parses a function [ input of the form (a [, b]*) ] and stores it
+ * as an nsCSSValue that holds a function of the form
+ * function-name arg1 arg2 ... argN
+ *
+ * On error, the return value is false.
+ *
+ * @param aFunction The name of the function that we're reading.
+ * @param aAllowedTypes An array of values corresponding to the legal
+ *        types for each element in the function.  The zeroth element in the
+ *        array corresponds to the first function parameter, etc.  The length
+ *        of this array _must_ be greater than or equal to aMaxElems or the
+ *        behavior is undefined.
+ * @param aMinElems Minimum number of elements to read.  Reading fewer than
+ *        this many elements will result in the function failing.
+ * @param aMaxElems Maximum number of elements to read.  Reading more than
+ *        this many elements will result in the function failing.
+ * @param aValue (out) The value that was parsed.
+ */
+bool
+CSSParserImpl::ParseFunction(const nsString &aFunction,
+                             const int32_t aAllowedTypes[],
+                             uint16_t aMinElems, uint16_t aMaxElems,
+                             nsCSSValue &aValue)
+{
+  typedef InfallibleTArray<nsCSSValue>::size_type arrlen_t;
+
+  /* 2^16 - 2, so that if we have 2^16 - 2 transforms, we have 2^16 - 1
+   * elements stored in the the nsCSSValue::Array.
+   */
+  static const arrlen_t MAX_ALLOWED_ELEMS = 0xFFFE;
+
+  /* Make a copy of the function name, since the reference is _probably_ to
+   * mToken.mIdent, which is going to get overwritten during the course of this
+   * function.
+   */
+  nsString functionName(aFunction);
+
+  /* Read in a list of values as an array, failing if we can't or if
+   * it's out of bounds.
+   */
+  InfallibleTArray<nsCSSValue> foundValues;
+  if (!ParseFunctionInternals(aAllowedTypes, aMinElems, aMaxElems,
+                              foundValues))
+    return false;
+
+  /* Now, convert this array into an nsCSSValue::Array object.
+   * We'll need N + 1 spots, one for the function name and the rest for the
+   * arguments.  In case the user has given us more than 2^16 - 2 arguments,
+   * we'll truncate them at 2^16 - 2 arguments.
+   */
+  uint16_t numElements = (foundValues.Length() <= MAX_ALLOWED_ELEMS ?
+                          foundValues.Length() + 1 : MAX_ALLOWED_ELEMS);
+  nsRefPtr<nsCSSValue::Array> convertedArray =
+    nsCSSValue::Array::Create(numElements);
+
+  /* Copy things over. */
+  convertedArray->Item(0).SetStringValue(functionName, eCSSUnit_Ident);
+  for (uint16_t index = 0; index + 1 < numElements; ++index)
+    convertedArray->Item(index + 1) = foundValues[static_cast<arrlen_t>(index)];
+
+  /* Fill in the outparam value with the array. */
+  aValue.SetArrayValue(convertedArray, eCSSUnit_Function);
+
+  /* Return it! */
+  return true;
+}
+
+/**
+ * Given a token, determines the minimum and maximum number of function
+ * parameters to read, along with the mask that should be used to read
+ * those function parameters.  If the token isn't a transform function,
+ * returns an error.
+ *
+ * @param aToken The token identifying the function.
+ * @param aMinElems [out] The minimum number of elements to read.
+ * @param aMaxElems [out] The maximum number of elements to read
+ * @param aVariantMask [out] The variant mask to use during parsing
+ * @return Whether the information was loaded successfully.
+ */
+static bool GetFunctionParseInformation(nsCSSKeyword aToken,
+                                        bool aIsPrefixed,
+                                        uint16_t &aMinElems,
+                                        uint16_t &aMaxElems,
+                                        const int32_t *& aVariantMask,
+                                        bool &aIs3D)
+{
+/* These types represent the common variant masks that will be used to
+   * parse out the individual functions.  The order in the enumeration
+   * must match the order in which the masks are declared.
+   */
+  enum { eLengthPercentCalc,
+         eLengthCalc,
+         eTwoLengthPercentCalcs,
+         eTwoLengthPercentCalcsOneLengthCalc,
+         eAngle,
+         eTwoAngles,
+         eNumber,
+         ePositiveLength,
+         eTwoNumbers,
+         eThreeNumbers,
+         eThreeNumbersOneAngle,
+         eMatrix,
+         eMatrixPrefixed,
+         eMatrix3d,
+         eMatrix3dPrefixed,
+         eNumVariantMasks };
+  static const int32_t kMaxElemsPerFunction = 16;
+  static const int32_t kVariantMasks[eNumVariantMasks][kMaxElemsPerFunction] = {
+    {VARIANT_LPCALC},
+    {VARIANT_LENGTH|VARIANT_CALC},
+    {VARIANT_LPCALC, VARIANT_LPCALC},
+    {VARIANT_LPCALC, VARIANT_LPCALC, VARIANT_LENGTH|VARIANT_CALC},
+    {VARIANT_ANGLE_OR_ZERO},
+    {VARIANT_ANGLE_OR_ZERO, VARIANT_ANGLE_OR_ZERO},
+    {VARIANT_NUMBER},
+    {VARIANT_LENGTH|VARIANT_POSITIVE_DIMENSION},
+    {VARIANT_NUMBER, VARIANT_NUMBER},
+    {VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER},
+    {VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_ANGLE_OR_ZERO},
+    {VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER,
+     VARIANT_NUMBER, VARIANT_NUMBER},
+    {VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER,
+     VARIANT_LPNCALC, VARIANT_LPNCALC},
+    {VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER,
+     VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER,
+     VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER,
+     VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER},
+    {VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER,
+     VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER,
+     VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER, VARIANT_NUMBER,
+     VARIANT_LPNCALC, VARIANT_LPNCALC, VARIANT_LNCALC, VARIANT_NUMBER}};
+
+#ifdef DEBUG
+  static const uint8_t kVariantMaskLengths[eNumVariantMasks] =
+    {1, 1, 2, 3, 1, 2, 1, 1, 2, 3, 4, 6, 6, 16, 16};
+#endif
+
+  int32_t variantIndex = eNumVariantMasks;
+
+  aIs3D = false;
+
+  switch (aToken) {
+  case eCSSKeyword_translatex:
+  case eCSSKeyword_translatey:
+    /* Exactly one length or percent. */
+    variantIndex = eLengthPercentCalc;
+    aMinElems = 1U;
+    aMaxElems = 1U;
+    break;
+  case eCSSKeyword_translatez:
+    /* Exactly one length */
+    variantIndex = eLengthCalc;
+    aMinElems = 1U;
+    aMaxElems = 1U;
+    aIs3D = true;
+    break;
+  case eCSSKeyword_translate3d:
+    /* Exactly two lengthds or percents and a number */
+    variantIndex = eTwoLengthPercentCalcsOneLengthCalc;
+    aMinElems = 3U;
+    aMaxElems = 3U;
+    aIs3D = true;
+    break;
+  case eCSSKeyword_scalez:
+    aIs3D = true;
+  case eCSSKeyword_scalex:
+  case eCSSKeyword_scaley:
+    /* Exactly one scale factor. */
+    variantIndex = eNumber;
+    aMinElems = 1U;
+    aMaxElems = 1U;
+    break;
+  case eCSSKeyword_scale3d:
+    /* Exactly three scale factors. */
+    variantIndex = eThreeNumbers;
+    aMinElems = 3U;
+    aMaxElems = 3U;
+    aIs3D = true;
+    break;
+  case eCSSKeyword_rotatex:
+  case eCSSKeyword_rotatey:
+    aIs3D = true;
+  case eCSSKeyword_rotate:
+  case eCSSKeyword_rotatez:
+    /* Exactly one angle. */
+    variantIndex = eAngle;
+    aMinElems = 1U;
+    aMaxElems = 1U;
+    break;
+  case eCSSKeyword_rotate3d:
+    variantIndex = eThreeNumbersOneAngle;
+    aMinElems = 4U;
+    aMaxElems = 4U;
+    aIs3D = true;
+    break;
+  case eCSSKeyword_translate:
+    /* One or two lengths or percents. */
+    variantIndex = eTwoLengthPercentCalcs;
+    aMinElems = 1U;
+    aMaxElems = 2U;
+    break;
+  case eCSSKeyword_skew:
+    /* Exactly one or two angles. */
+    variantIndex = eTwoAngles;
+    aMinElems = 1U;
+    aMaxElems = 2U;
+    break;
+  case eCSSKeyword_scale:
+    /* One or two scale factors. */
+    variantIndex = eTwoNumbers;
+    aMinElems = 1U;
+    aMaxElems = 2U;
+    break;
+  case eCSSKeyword_skewx:
+    /* Exactly one angle. */
+    variantIndex = eAngle;
+    aMinElems = 1U;
+    aMaxElems = 1U;
+    break;
+  case eCSSKeyword_skewy:
+    /* Exactly one angle. */
+    variantIndex = eAngle;
+    aMinElems = 1U;
+    aMaxElems = 1U;
+    break;
+  case eCSSKeyword_matrix:
+    /* Six values, all numbers. */
+    variantIndex = aIsPrefixed ? eMatrixPrefixed : eMatrix;
+    aMinElems = 6U;
+    aMaxElems = 6U;
+    break;
+  case eCSSKeyword_matrix3d:
+    /* 16 matrix values, all numbers */
+    variantIndex = aIsPrefixed ? eMatrix3dPrefixed : eMatrix3d;
+    aMinElems = 16U;
+    aMaxElems = 16U;
+    aIs3D = true;
+    break;
+  case eCSSKeyword_perspective:
+    /* Exactly one scale number. */
+    variantIndex = ePositiveLength;
+    aMinElems = 1U;
+    aMaxElems = 1U;
+    aIs3D = true;
+    break;
+  default:
+    /* Oh dear, we didn't match.  Report an error. */
+    return false;
+  }
+
+  NS_ASSERTION(aMinElems > 0, "Didn't update minimum elements!");
+  NS_ASSERTION(aMaxElems > 0, "Didn't update maximum elements!");
+  NS_ASSERTION(aMinElems <= aMaxElems, "aMinElems > aMaxElems!");
+  NS_ASSERTION(variantIndex >= 0, "Invalid variant mask!");
+  NS_ASSERTION(variantIndex < eNumVariantMasks, "Invalid variant mask!");
+#ifdef DEBUG
+  NS_ASSERTION(aMaxElems <= kVariantMaskLengths[variantIndex],
+               "Invalid aMaxElems for this variant mask.");
+#endif
+
+  // Convert the index into a mask.
+  aVariantMask = kVariantMasks[variantIndex];
+
+  return true;
+}
+
+/* Reads a single transform function from the tokenizer stream, reporting an
+ * error if something goes wrong.
+ */
+bool
+CSSParserImpl::ParseSingleTransform(bool aIsPrefixed,
+                                    nsCSSValue& aValue, bool& aIs3D)
+{
+  if (!GetToken(true))
+    return false;
+
+  if (mToken.mType != eCSSToken_Function) {
+    UngetToken();
+    return false;
+  }
+
+  const int32_t* variantMask;
+  uint16_t minElems, maxElems;
+  nsCSSKeyword keyword = nsCSSKeywords::LookupKeyword(mToken.mIdent);
+
+  if (!GetFunctionParseInformation(keyword, aIsPrefixed,
+                                   minElems, maxElems, variantMask, aIs3D))
+    return false;
+
+  // Bug 721136: Normalize the identifier to lowercase, except that things
+  // like scaleX should have the last character capitalized.  This matches
+  // what other browsers do.
+  nsContentUtils::ASCIIToLower(mToken.mIdent);
+  switch (keyword) {
+    case eCSSKeyword_rotatex:
+    case eCSSKeyword_scalex:
+    case eCSSKeyword_skewx:
+    case eCSSKeyword_translatex:
+      mToken.mIdent.Replace(mToken.mIdent.Length() - 1, 1, PRUnichar('X'));
+      break;
+
+    case eCSSKeyword_rotatey:
+    case eCSSKeyword_scaley:
+    case eCSSKeyword_skewy:
+    case eCSSKeyword_translatey:
+      mToken.mIdent.Replace(mToken.mIdent.Length() - 1, 1, PRUnichar('Y'));
+      break;
+
+    case eCSSKeyword_rotatez:
+    case eCSSKeyword_scalez:
+    case eCSSKeyword_translatez:
+      mToken.mIdent.Replace(mToken.mIdent.Length() - 1, 1, PRUnichar('Z'));
+      break;
+
+    default:
+      break;
+  }
+
+  return ParseFunction(mToken.mIdent, variantMask, minElems, maxElems, aValue);
+}
+
+/* Parses a transform property list by continuously reading in properties
+ * and constructing a matrix from it.
+ */
+bool CSSParserImpl::ParseTransform(bool aIsPrefixed)
+{
+  nsCSSValue value;
+  if (ParseVariant(value, VARIANT_INHERIT | VARIANT_NONE, nullptr)) {
+    // 'inherit', 'initial', and 'none' must be alone
+    if (!ExpectEndProperty()) {
+      return false;
+    }
+  } else {
+    nsCSSValueList* cur = value.SetListValue();
+    for (;;) {
+      bool is3D;
+      if (!ParseSingleTransform(aIsPrefixed, cur->mValue, is3D)) {
+        return false;
+      }
+      if (is3D && !nsLayoutUtils::Are3DTransformsEnabled()) {
+        return false;
+      }
+      if (CheckEndProperty()) {
+        break;
+      }
+      cur->mNext = new nsCSSValueList;
+      cur = cur->mNext;
+    }
+  }
+  AppendValue(eCSSProperty_transform, value);
+  return true;
+}
+
+bool CSSParserImpl::ParseTransformOrigin(bool aPerspective)
+{
+  nsCSSValuePair position;
+  if (!ParseBoxPositionValues(position, true))
+    return false;
+
+  nsCSSProperty prop = eCSSProperty_transform_origin;
+  if (aPerspective) {
+    if (!ExpectEndProperty()) {
+      return false;
+    }
+    prop = eCSSProperty_perspective_origin;
+  }
+
+  // Unlike many other uses of pairs, this position should always be stored
+  // as a pair, even if the values are the same, so it always serializes as
+  // a pair, and to keep the computation code simple.
+  if (position.mXValue.GetUnit() == eCSSUnit_Inherit ||
+      position.mXValue.GetUnit() == eCSSUnit_Initial) {
+    NS_ABORT_IF_FALSE(position.mXValue == position.mYValue,
+                      "inherit/initial only half?");
+    AppendValue(prop, position.mXValue);
+  } else {
+    nsCSSValue value;
+    if (aPerspective) {
+      value.SetPairValue(position.mXValue, position.mYValue);
+    } else {
+      nsCSSValue depth;
+      if (!nsLayoutUtils::Are3DTransformsEnabled() ||
+          // only try parsing if 3-D transforms are enabled
+          !ParseVariant(depth, VARIANT_LENGTH | VARIANT_CALC, nullptr)) {
+        depth.SetFloatValue(0.0f, eCSSUnit_Pixel);
+      }
+      value.SetTripletValue(position.mXValue, position.mYValue, depth);
+    }
+
+    AppendValue(prop, value);
+  }
+  return true;
+}
+
 bool
 CSSParserImpl::ParseTransitionProperty()
 {
diff --git a/layout/style/nsCSSRuleProcessor.cpp b/layout/style/nsCSSRuleProcessor.cpp
index cc5869f86f71..4b1e97c5a1d5 100644
--- a/layout/style/nsCSSRuleProcessor.cpp
+++ b/layout/style/nsCSSRuleProcessor.cpp
@@ -1051,12 +1051,17 @@ RuleCascadeData::AttributeListFor(nsIAtom* aAttribute)
 //
 
 nsCSSRuleProcessor::nsCSSRuleProcessor(const sheet_array_type& aSheets,
-                                       uint8_t aSheetType)
+                                       uint8_t aSheetType,
+                                       Element* aScopeElement)
   : mSheets(aSheets)
   , mRuleCascades(nullptr)
   , mLastPresContext(nullptr)
   , mSheetType(aSheetType)
+  , mScopeElement(aScopeElement)
 {
+  NS_ASSERTION(!!mScopeElement == (aSheetType == nsStyleSet::eScopedDocSheet),
+               "aScopeElement must be specified iff aSheetType is "
+               "eScopedDocSheet");
   for (sheet_array_type::size_type i = mSheets.Length(); i-- != 0; ) {
     mSheets[i]->AddRuleProcessor(this);
   }
@@ -2197,6 +2202,13 @@ static bool SelectorMatchesTree(Element* aPrevElement,
                  selector->mNext->mOperator != PRUnichar(0),
                  "compound selector without combinator");
 
+    // If after the previous selector match we are now outside the
+    // current style scope, we don't need to match any further.
+    if (aTreeMatchContext.mForScopedStyle &&
+        !aTreeMatchContext.IsWithinStyleScopeForSelectorMatching()) {
+      return false;
+    }
+
     // for adjacent sibling combinators, the content to test against the
     // selector is the previous sibling *element*
     Element* element = nullptr;
@@ -2227,6 +2239,13 @@ static bool SelectorMatchesTree(Element* aPrevElement,
       // element parents.
       if (content && content->IsElement()) {
         element = content->AsElement();
+        if (aTreeMatchContext.mForScopedStyle) {
+          // We are moving up to the parent element; tell the
+          // TreeMatchContext, so that in case this element is the
+          // style scope element, selector matching stops before we
+          // traverse further up the tree.
+          aTreeMatchContext.PopStyleScopeForSelectorMatching(element);
+        }
       }
     }
     if (!element) {
@@ -2298,6 +2317,12 @@ void ContentEnumFunc(const RuleValue& value, nsCSSSelector* aSelector,
     // We won't match; nothing else to do here
     return;
   }
+  if (!data->mTreeMatchContext.SetStyleScopeForSelectorMatching(data->mElement,
+                                                                data->mScope)) {
+    // The selector is for a rule in a scoped style sheet, and the subject
+    // of the selector matching is not in its scope.
+    return;
+  }
   if (SelectorMatches(data->mElement, aSelector, nodeContext,
                       data->mTreeMatchContext)) {
     nsCSSSelector *next = aSelector->mNext;
@@ -2482,6 +2507,13 @@ AttributeEnumFunc(nsCSSSelector* aSelector, AttributeEnumData* aData)
 {
   AttributeRuleProcessorData *data = aData->data;
 
+  if (!data->mTreeMatchContext.SetStyleScopeForSelectorMatching(data->mElement,
+                                                                data->mScope)) {
+    // The selector is for a rule in a scoped style sheet, and the subject
+    // of the selector matching is not in its scope.
+    return;
+  }
+
   nsRestyleHint possibleChange = RestyleHintForOp(aSelector->mOperator);
 
   // If enumData->change already includes all the bits of possibleChange, don't
@@ -3256,14 +3288,14 @@ nsCSSRuleProcessor::SelectorListMatches(Element* aElement,
   return false;
 }
 
-// AncestorFilter out of line methods
+// TreeMatchContext and AncestorFilter out of line methods
 void
-AncestorFilter::Init(Element *aElement)
+TreeMatchContext::InitAncestors(Element *aElement)
 {
-  MOZ_ASSERT(!mFilter);
-  MOZ_ASSERT(mHashes.IsEmpty());
+  MOZ_ASSERT(!mAncestorFilter.mFilter);
+  MOZ_ASSERT(mAncestorFilter.mHashes.IsEmpty());
 
-  mFilter = new Filter();
+  mAncestorFilter.mFilter = new AncestorFilter::Filter();
 
   if (MOZ_LIKELY(aElement)) {
     MOZ_ASSERT(aElement->IsInDoc(),
@@ -3284,7 +3316,8 @@ AncestorFilter::Init(Element *aElement)
 
     // Now push them in reverse order.
     for (uint32_t i = ancestors.Length(); i-- != 0; ) {
-      PushAncestor(ancestors[i]);
+      mAncestorFilter.PushAncestor(ancestors[i]);
+      PushStyleScope(ancestors[i]);
     }
   }
 }
diff --git a/layout/style/nsCSSRuleProcessor.h b/layout/style/nsCSSRuleProcessor.h
index 905eb47deefb..f0167930dd10 100644
--- a/layout/style/nsCSSRuleProcessor.h
+++ b/layout/style/nsCSSRuleProcessor.h
@@ -43,7 +43,11 @@ class nsCSSRuleProcessor: public nsIStyleRuleProcessor {
 public:
   typedef nsTArray<nsRefPtr<nsCSSStyleSheet> > sheet_array_type;
 
-  nsCSSRuleProcessor(const sheet_array_type& aSheets, uint8_t aSheetType);
+  // aScopeElement must be non-null iff aSheetType is
+  // nsStyleSet::eScopedDocSheet.
+  nsCSSRuleProcessor(const sheet_array_type& aSheets,
+                     uint8_t aSheetType,
+                     mozilla::dom::Element* aScopeElement);
   virtual ~nsCSSRuleProcessor();
 
   NS_DECL_ISUPPORTS
@@ -124,6 +128,13 @@ public:
   bool AppendPageRules(nsPresContext* aPresContext,
                        nsTArray<nsCSSPageRule*>& aArray);
 
+  /**
+   * Returns the scope element for the scoped style sheets this rule
+   * processor is for.  If this is not a rule processor for scoped style
+   * sheets, it returns null.
+   */
+  mozilla::dom::Element* GetScopeElement() const { return mScopeElement; }
+
 #ifdef DEBUG
   void AssertQuirksChangeOK() {
     NS_ASSERTION(!mRuleCascades, "can't toggle quirks style sheet without "
@@ -163,7 +174,11 @@ private:
 
   // The last pres context for which GetRuleCascades was called.
   nsPresContext *mLastPresContext;
-  
+
+  // The scope element for this rule processor's scoped style sheets.
+  // Only used if mSheetType == nsStyleSet::eScopedDocSheet.
+  nsRefPtr<mozilla::dom::Element> mScopeElement;
+
   // type of stylesheet using this processor
   uint8_t mSheetType;  // == nsStyleSet::sheetType
 
diff --git a/layout/style/nsCSSStyleSheet.cpp b/layout/style/nsCSSStyleSheet.cpp
index 762325faaee1..4df5106da4cc 100644
--- a/layout/style/nsCSSStyleSheet.cpp
+++ b/layout/style/nsCSSStyleSheet.cpp
@@ -11,6 +11,7 @@
 #include "nsCRT.h"
 #include "nsIAtom.h"
 #include "nsCSSRuleProcessor.h"
+#include "mozilla/dom/Element.h"
 #include "mozilla/css/NameSpaceRule.h"
 #include "mozilla/css/GroupRule.h"
 #include "mozilla/css/ImportRule.h"
@@ -41,6 +42,7 @@
 #include "mozilla/Likely.h"
 
 using namespace mozilla;
+using namespace mozilla::dom;
 
 
 // -------------------------------
@@ -1033,6 +1035,7 @@ nsCSSStyleSheet::nsCSSStyleSheet(CORSMode aCORSMode)
     mOwningNode(nullptr),
     mDisabled(false),
     mDirty(false),
+    mScopeElement(nullptr),
     mRuleProcessors(nullptr)
 {
 
@@ -1051,6 +1054,7 @@ nsCSSStyleSheet::nsCSSStyleSheet(const nsCSSStyleSheet& aCopy,
     mOwningNode(aOwningNodeToUse),
     mDisabled(aCopy.mDisabled),
     mDirty(aCopy.mDirty),
+    mScopeElement(nullptr),
     mInner(aCopy.mInner),
     mRuleProcessors(nullptr)
 {
@@ -1197,12 +1201,14 @@ NS_IMPL_CYCLE_COLLECTION_UNLINK_BEGIN(nsCSSStyleSheet)
   // unlinked before it does.
   tmp->DropRuleCollection();
   tmp->UnlinkInner();
+  tmp->mScopeElement = nullptr;
 NS_IMPL_CYCLE_COLLECTION_UNLINK_END
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_BEGIN(nsCSSStyleSheet)
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mMedia)
   // We do not traverse mNext; our parent will handle that.  See
   // comments in Unlink for why.
   NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mRuleCollection)
+  NS_IMPL_CYCLE_COLLECTION_TRAVERSE(mScopeElement)
   tmp->TraverseInner(cb);
 NS_IMPL_CYCLE_COLLECTION_TRAVERSE_END
 
diff --git a/layout/style/nsCSSStyleSheet.h b/layout/style/nsCSSStyleSheet.h
index 3227ca1fc454..309670b35495 100644
--- a/layout/style/nsCSSStyleSheet.h
+++ b/layout/style/nsCSSStyleSheet.h
@@ -10,6 +10,7 @@
 #define nsCSSStyleSheet_h_
 
 #include "mozilla/Attributes.h"
+#include "mozilla/dom/Element.h"
 
 #include "nscore.h"
 #include "nsCOMPtr.h"
@@ -247,6 +248,12 @@ public:
   // Get this style sheet's CORS mode
   mozilla::CORSMode GetCORSMode() const { return mInner->mCORSMode; }
 
+  mozilla::dom::Element* GetScopeElement() const { return mScopeElement; }
+  void SetScopeElement(mozilla::dom::Element* aScopeElement)
+  {
+    mScopeElement = aScopeElement;
+  }
+
 private:
   nsCSSStyleSheet(const nsCSSStyleSheet& aCopy,
                   nsCSSStyleSheet* aParentToUse,
@@ -297,6 +304,7 @@ protected:
   nsIDOMNode*           mOwningNode; // weak ref
   bool                  mDisabled;
   bool                  mDirty; // has been modified 
+  nsRefPtr<mozilla::dom::Element> mScopeElement;
 
   nsCSSStyleSheetInner* mInner;
 
diff --git a/layout/style/nsRuleData.cpp b/layout/style/nsRuleData.cpp
index 66051e48ae31..fd0324c1fe9d 100644
--- a/layout/style/nsRuleData.cpp
+++ b/layout/style/nsRuleData.cpp
@@ -32,7 +32,6 @@ nsRuleData::nsRuleData(uint32_t aSIDs, nsCSSValue* aValueStorage,
     mCanStoreInRuleTree(true),
     mPresContext(aContext),
     mStyleContext(aStyleContext),
-    mPostResolveCallback(nullptr),
     mValueStorage(aValueStorage)
 {
 #ifndef MOZ_VALGRIND
diff --git a/layout/style/nsRuleData.h b/layout/style/nsRuleData.h
index db5ac9c4a927..5b9cea03ebd1 100644
--- a/layout/style/nsRuleData.h
+++ b/layout/style/nsRuleData.h
@@ -25,10 +25,9 @@ struct nsRuleData
   const uint32_t mSIDs;
   bool mCanStoreInRuleTree;
   bool mIsImportantRule;
-  uint8_t mLevel; // an nsStyleSet::sheetType
+  uint16_t mLevel; // an nsStyleSet::sheetType
   nsPresContext* const mPresContext;
   nsStyleContext* const mStyleContext;
-  const nsPostResolveFunc mPostResolveCallback;
 
   // We store nsCSSValues needed to compute the data for one or more
   // style structs (specified by the bitfield mSIDs).  These are stored
diff --git a/layout/style/nsRuleNode.cpp b/layout/style/nsRuleNode.cpp
index f48588f70133..4f203875e8c6 100644
--- a/layout/style/nsRuleNode.cpp
+++ b/layout/style/nsRuleNode.cpp
@@ -2008,7 +2008,7 @@ nsRuleNode::WalkRuleTree(const nsStyleStructID aSID,
     detail = eRulePartialMixed; // Treat as though some data is specified to avoid
                                 // the optimizations and force data computation.
 
-  if (detail == eRuleNone && startStruct && !ruleData.mPostResolveCallback) {
+  if (detail == eRuleNone && startStruct) {
     // We specified absolutely no rule information, but a parent rule in the tree
     // specified all the rule information.  We set a bit along the branch from our
     // node in the tree to the node that specified the data that tells nodes on that
@@ -2017,7 +2017,6 @@ nsRuleNode::WalkRuleTree(const nsStyleStructID aSID,
     PropagateDependentBit(aSID, ruleNode, startStruct);
     return startStruct;
   }
-  // FIXME Do we need to check for mPostResolveCallback?
   if ((!startStruct && !isReset &&
        (detail == eRuleNone || detail == eRulePartialInherited)) ||
       detail == eRuleFullInherited) {
@@ -2072,10 +2071,6 @@ nsRuleNode::WalkRuleTree(const nsStyleStructID aSID,
 #undef STYLE_STRUCT
 #undef STYLE_STRUCT_TEST
 
-  // If we have a post-resolve callback, handle that now.
-  if (ruleData.mPostResolveCallback && (MOZ_LIKELY(res != nullptr)))
-    (*ruleData.mPostResolveCallback)(const_cast<void*>(res), &ruleData);
-
   // Now return the result.
   return res;
 }
@@ -3450,11 +3445,6 @@ nsRuleNode::SetGenericFont(nsPresContext* aPresContext,
                         aGenericFontID, &ruleData, &parentFont, aFont,
                         false, dummy);
 
-    // XXX Not sure if we need to do this here
-    // If we have a post-resolve callback, handle that now.
-    if (ruleData.mPostResolveCallback)
-      (ruleData.mPostResolveCallback)(aFont, &ruleData);
-
     parentFont = *aFont;
   }
 }
diff --git a/layout/style/nsRuleNode.h b/layout/style/nsRuleNode.h
index 8544c35b6fee..87b2f3f8d175 100644
--- a/layout/style/nsRuleNode.h
+++ b/layout/style/nsRuleNode.h
@@ -645,7 +645,7 @@ public:
   nsRuleNode* GetParent() const { return mParent; }
   bool IsRoot() const { return mParent == nullptr; }
 
-  // These PRUint8s are really nsStyleSet::sheetType values.
+  // These uint8_ts are really nsStyleSet::sheetType values.
   uint8_t GetLevel() const {
     NS_ASSERTION(!IsRoot(), "can't call on root");
     return (mDependentBits & NS_RULE_NODE_LEVEL_MASK) >>
diff --git a/layout/style/nsRuleProcessorData.h b/layout/style/nsRuleProcessorData.h
index deddac717842..368f0d58ccbc 100644
--- a/layout/style/nsRuleProcessorData.h
+++ b/layout/style/nsRuleProcessorData.h
@@ -26,6 +26,7 @@ class nsIStyleSheet;
 class nsIAtom;
 class nsICSSPseudoComparator;
 class nsAttrValue;
+struct TreeMatchContext;
 
 /**
  * An AncestorFilter is used to keep track of ancestors so that we can
@@ -33,44 +34,12 @@ class nsAttrValue;
  * element.
  */
 class NS_STACK_CLASS AncestorFilter {
+  friend struct TreeMatchContext;
  public:
-  /**
-   * Initialize the filter.  If aElement is not null, it and all its
-   * ancestors will be passed to PushAncestor, starting from the root
-   * and going down the tree.
-   */
-  void Init(mozilla::dom::Element *aElement);
-
   /* Maintenance of our ancestor state */
   void PushAncestor(mozilla::dom::Element *aElement);
   void PopAncestor();
 
-  /* Helper class for maintaining the ancestor state */
-  class NS_STACK_CLASS AutoAncestorPusher {
-  public:
-    AutoAncestorPusher(bool aDoPush,
-                       AncestorFilter &aFilter,
-                       mozilla::dom::Element *aElement
-                       MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
-      : mPushed(aDoPush && aElement), mFilter(aFilter)
-    {
-      MOZ_GUARD_OBJECT_NOTIFIER_INIT;
-      if (mPushed) {
-        mFilter.PushAncestor(aElement);
-      }
-    }
-    ~AutoAncestorPusher() {
-      if (mPushed) {
-        mFilter.PopAncestor();
-      }
-    }
-
-  private:
-    bool mPushed;
-    AncestorFilter &mFilter;
-    MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
-  };
-
   /* Check whether we might have an ancestor matching one of the given
      atom hashes.  |hashes| must have length hashListLength */
   template<size_t hashListLength>
@@ -164,6 +133,114 @@ struct NS_STACK_CLASS TreeMatchContext {
     return mHaveSpecifiedScope;
   }
 
+  /**
+   * Initialize the ancestor filter and list of style scopes.  If aElement is
+   * not null, it and all its ancestors will be passed to
+   * mAncestorFilter.PushAncestor and PushStyleScope, starting from the root and
+   * going down the tree.
+   */
+  void InitAncestors(mozilla::dom::Element *aElement);
+
+  void PushStyleScope(mozilla::dom::Element* aElement)
+  {
+    NS_PRECONDITION(aElement, "aElement must not be null");
+    if (aElement->IsScopedStyleRoot()) {
+      mStyleScopes.AppendElement(aElement);
+    }
+  }
+
+  void PopStyleScope(mozilla::dom::Element* aElement)
+  {
+    NS_PRECONDITION(aElement, "aElement must not be null");
+    if (mStyleScopes.SafeLastElement(nullptr) == aElement) {
+      mStyleScopes.TruncateLength(mStyleScopes.Length() - 1);
+    }
+  }
+ 
+  bool PopStyleScopeForSelectorMatching(mozilla::dom::Element* aElement)
+  {
+    NS_ASSERTION(mForScopedStyle, "only call PopScopeForSelectorMatching when "
+                                  "mForScopedStyle is true");
+
+    if (!mCurrentStyleScope) {
+      return false;
+    }
+    if (mCurrentStyleScope == aElement) {
+      mCurrentStyleScope = nullptr;
+    }
+    return true;
+  }
+
+  bool SetStyleScopeForSelectorMatching(mozilla::dom::Element* aSubject,
+                                        mozilla::dom::Element* aScope)
+  {
+    mForScopedStyle = !!aScope;
+    if (!aScope) {
+      // This is not for a scoped style sheet; return true, as we want
+      // selector matching to proceed.
+      mCurrentStyleScope = nullptr;
+      return true;
+    }
+    if (aScope == aSubject) {
+      // Although the subject is the same element as the scope, as soon
+      // as we continue with selector matching up the tree we don't want
+      // to match any more elements.  So we return true to indicate that
+      // we want to do the initial selector matching, but set
+      // mCurrentStyleScope to null so that no ancestor elements will match.
+      mCurrentStyleScope = nullptr;
+      return true;
+    }
+    if (mStyleScopes.Contains(aScope)) {
+      // mStyleScopes contains all of the scope elements that are ancestors of
+      // aSubject, so if aScope is in mStyleScopes, then we do want selector
+      // matching to proceed.
+      mCurrentStyleScope = aScope;
+      return true;
+    }
+    // Otherwise, we're not in the scope, and we don't want to proceed
+    // with selector matching.
+    mCurrentStyleScope = nullptr;
+    return false;
+  }
+
+  bool IsWithinStyleScopeForSelectorMatching() const
+  {
+    NS_ASSERTION(mForScopedStyle, "only call IsWithinScopeForSelectorMatching "
+                                  "when mForScopedStyle is true");
+    return mCurrentStyleScope;
+  }
+
+  /* Helper class for maintaining the ancestor state */
+  class NS_STACK_CLASS AutoAncestorPusher {
+  public:
+    AutoAncestorPusher(bool aDoPush,
+                       TreeMatchContext &aTreeMatchContext,
+                       mozilla::dom::Element *aElement
+                       MOZ_GUARD_OBJECT_NOTIFIER_PARAM)
+      : mPushed(aDoPush && aElement),
+        mTreeMatchContext(aTreeMatchContext),
+        mElement(aElement)
+    {
+      MOZ_GUARD_OBJECT_NOTIFIER_INIT;
+      if (mPushed) {
+        mTreeMatchContext.mAncestorFilter.PushAncestor(aElement);
+        mTreeMatchContext.PushStyleScope(aElement);
+      }
+    }
+    ~AutoAncestorPusher() {
+      if (mPushed) {
+        mTreeMatchContext.mAncestorFilter.PopAncestor();
+        mTreeMatchContext.PopStyleScope(mElement);
+      }
+    }
+
+  private:
+    bool mPushed;
+    TreeMatchContext& mTreeMatchContext;
+    mozilla::dom::Element* mElement;
+    MOZ_DECL_USE_GUARD_OBJECT_NOTIFIER
+  };
+
   // Is this matching operation for the creation of a style context?
   // (If it is, we need to set slow selector bits on nodes indicating
   // that certain restyling needs to happen.)
@@ -213,11 +290,22 @@ struct NS_STACK_CLASS TreeMatchContext {
   // Whether this document is using PB mode
   bool mUsingPrivateBrowsing;
 
+  // Whether this TreeMatchContext is being used with an nsCSSRuleProcessor
+  // for an HTML5 scoped style sheet.
+  bool mForScopedStyle;
+
   enum MatchVisited {
     eNeverMatchVisited,
     eMatchVisitedDefault
   };
 
+  // List of ancestor elements that define a style scope (due to having a
+  // <style scoped> child).
+  nsAutoTArray<mozilla::dom::Element*, 1> mStyleScopes;
+
+  // The current style scope element for selector matching.
+  mozilla::dom::Element* mCurrentStyleScope;
+
   // Constructor to use when creating a tree match context for styling
   TreeMatchContext(bool aForStyling,
                    nsRuleWalker::VisitedHandlingType aVisitedHandling,
@@ -232,6 +320,8 @@ struct NS_STACK_CLASS TreeMatchContext {
     , mIsHTMLDocument(aDocument->IsHTML())
     , mCompatMode(aDocument->GetCompatibilityMode())
     , mUsingPrivateBrowsing(false)
+    , mForScopedStyle(false)
+    , mCurrentStyleScope(nullptr)
   {
     if (aMatchVisited != eNeverMatchVisited) {
       nsCOMPtr<nsISupports> container = mDocument->GetContainer();
@@ -250,13 +340,15 @@ struct NS_STACK_CLASS RuleProcessorData {
   RuleProcessorData(nsPresContext* aPresContext,
                     nsRuleWalker* aRuleWalker)
     : mPresContext(aPresContext),
-      mRuleWalker(aRuleWalker)
+      mRuleWalker(aRuleWalker),
+      mScope(nullptr)
   {
     NS_PRECONDITION(mPresContext, "Must have prescontext");
   }
 
   nsPresContext* const mPresContext;
   nsRuleWalker* const mRuleWalker; // Used to add rules to our results.
+  mozilla::dom::Element* mScope;
 };
 
 struct NS_STACK_CLASS ElementDependentRuleProcessorData :
diff --git a/layout/style/nsStyleAnimation.cpp b/layout/style/nsStyleAnimation.cpp
index 6879b10a43ee..a2cc751d4ab2 100644
--- a/layout/style/nsStyleAnimation.cpp
+++ b/layout/style/nsStyleAnimation.cpp
@@ -391,11 +391,17 @@ nsStyleAnimation::ComputeDistance(nsCSSProperty aProperty,
           return false;
       }
    case eUnit_Visibility: {
-      int32_t startVal =
-        aStartValue.GetIntValue() == NS_STYLE_VISIBILITY_VISIBLE;
-      int32_t endVal =
-        aEndValue.GetIntValue() == NS_STYLE_VISIBILITY_VISIBLE;
-      aDistance = std::abs(startVal - endVal);
+      int32_t startEnum = aStartValue.GetIntValue();
+      int32_t endEnum = aEndValue.GetIntValue();
+      if (startEnum == endEnum) {
+        aDistance = 0;
+        return true;
+      }
+      if ((startEnum == NS_STYLE_VISIBILITY_VISIBLE) ==
+          (endEnum == NS_STYLE_VISIBILITY_VISIBLE)) {
+        return false;
+      }
+      aDistance = 1;
       return true;
     }
     case eUnit_Integer: {
@@ -1706,11 +1712,21 @@ nsStyleAnimation::AddWeighted(nsCSSProperty aProperty,
           return false;
       }
     case eUnit_Visibility: {
-      int32_t val1 = aValue1.GetIntValue() == NS_STYLE_VISIBILITY_VISIBLE;
-      int32_t val2 = aValue2.GetIntValue() == NS_STYLE_VISIBILITY_VISIBLE;
+      int32_t enum1 = aValue1.GetIntValue();
+      int32_t enum2 = aValue2.GetIntValue();
+      if (enum1 == enum2) {
+        aResultValue.SetIntValue(enum1, eUnit_Visibility);
+        return true;
+      }
+      if ((enum1 == NS_STYLE_VISIBILITY_VISIBLE) ==
+          (enum2 == NS_STYLE_VISIBILITY_VISIBLE)) {
+        return false;
+      }
+      int32_t val1 = enum1 == NS_STYLE_VISIBILITY_VISIBLE;
+      int32_t val2 = enum2 == NS_STYLE_VISIBILITY_VISIBLE;
       double interp = aCoeff1 * val1 + aCoeff2 * val2;
       int32_t result = interp > 0.0 ? NS_STYLE_VISIBILITY_VISIBLE
-                                    : NS_STYLE_VISIBILITY_HIDDEN;
+                                    : (val1 ? enum2 : enum1);
       aResultValue.SetIntValue(result, eUnit_Visibility);
       return true;
     }
diff --git a/layout/style/nsStyleSet.cpp b/layout/style/nsStyleSet.cpp
index 020d8f4ba512..b3ecfa31af54 100644
--- a/layout/style/nsStyleSet.cpp
+++ b/layout/style/nsStyleSet.cpp
@@ -21,6 +21,7 @@
 #include "nsCSSAnonBoxes.h"
 #include "nsCSSPseudoElements.h"
 #include "nsCSSRuleProcessor.h"
+#include "nsDataHashtable.h"
 #include "nsIContent.h"
 #include "nsRuleData.h"
 #include "nsRuleProcessorData.h"
@@ -100,6 +101,7 @@ static const nsStyleSet::sheetType gCSSSheetTypes[] = {
   nsStyleSet::eAgentSheet,
   nsStyleSet::eUserSheet,
   nsStyleSet::eDocSheet,
+  nsStyleSet::eScopedDocSheet,
   nsStyleSet::eOverrideSheet
 };
 
@@ -208,11 +210,101 @@ nsStyleSet::SetQuirkStyleSheet(nsIStyleSheet* aQuirkStyleSheet)
   mQuirkStyleSheet = aQuirkStyleSheet;
 }
 
+typedef nsDataHashtable<nsPtrHashKey<nsINode>, uint32_t> ScopeDepthCache;
+
+// Returns the depth of a style scope element, with 1 being the depth of
+// a style scope element that has no ancestor style scope elements.  The
+// depth does not count intervening non-scope elements.
+static uint32_t
+GetScopeDepth(nsINode* aScopeElement, ScopeDepthCache& aCache)
+{
+  nsINode* parent = aScopeElement->GetParent();
+  if (!parent || !parent->IsElementInStyleScope()) {
+    return 1;
+  }
+
+  uint32_t depth = aCache.Get(aScopeElement);
+  if (!depth) {
+    for (nsINode* n = parent; n; n = n->GetParent()) {
+      if (n->IsScopedStyleRoot()) {
+        depth = GetScopeDepth(n, aCache) + 1;
+        aCache.Put(aScopeElement, depth);
+        break;
+      }
+    }
+  }
+  return depth;
+}
+
+struct ScopedSheetOrder
+{
+  nsCSSStyleSheet* mSheet;
+  uint32_t mDepth;
+  uint32_t mOrder;
+
+  bool operator==(const ScopedSheetOrder& aRHS) const
+  {
+    return mDepth == aRHS.mDepth &&
+           mOrder == aRHS.mOrder;
+  }
+
+  bool operator<(const ScopedSheetOrder& aRHS) const
+  {
+    if (mDepth != aRHS.mDepth) {
+      return mDepth < aRHS.mDepth;
+    }
+    return mOrder < aRHS.mOrder;
+  }
+};
+
+// Sorts aSheets such that style sheets for ancestor scopes come
+// before those for descendant scopes, and with sheets for a single
+// scope in document order.
+static void
+SortStyleSheetsByScope(nsTArray<nsCSSStyleSheet*>& aSheets)
+{
+  uint32_t n = aSheets.Length();
+  if (n == 1) {
+    return;
+  }
+
+  ScopeDepthCache cache;
+  cache.Init();
+
+  nsTArray<ScopedSheetOrder> sheets;
+  sheets.SetLength(n);
+
+  // For each sheet, record the depth of its scope element and its original
+  // document order.
+  for (uint32_t i = 0; i < n; i++) {
+    sheets[i].mSheet = aSheets[i];
+    sheets[i].mDepth = GetScopeDepth(aSheets[i]->GetScopeElement(), cache);
+    sheets[i].mOrder = i;
+  }
+
+  // Sort by depth first, then document order.
+  sheets.Sort();
+
+  for (uint32_t i = 0; i < n; i++) {
+    aSheets[i] = sheets[i].mSheet;
+  }
+}
+
 nsresult
 nsStyleSet::GatherRuleProcessors(sheetType aType)
 {
   mRuleProcessors[aType] = nullptr;
+  if (aType == eScopedDocSheet) {
+    for (int i = 0; i < mScopedDocSheetRuleProcessors.Length(); i++) {
+      nsIStyleRuleProcessor* processor = mScopedDocSheetRuleProcessors[i].get();
+      Element* scope =
+        static_cast<nsCSSRuleProcessor*>(processor)->GetScopeElement();
+      scope->ClearIsScopedStyleRoot();
+    }
+    mScopedDocSheetRuleProcessors.Clear();
+  }
   if (mAuthorStyleDisabled && (aType == eDocSheet || 
+                               aType == eScopedDocSheet ||
                                aType == ePresHintSheet ||
                                aType == eStyleAttrSheet)) {
     //don't regather if this level is disabled
@@ -232,13 +324,56 @@ nsStyleSet::GatherRuleProcessors(sheetType aType)
     mRuleProcessors[aType] = PresContext()->TransitionManager();
     return NS_OK;
   }
+  if (aType == eScopedDocSheet) {
+    // Create a rule processor for each scope.
+    uint32_t count = mSheets[eScopedDocSheet].Count();
+    if (count) {
+      // Gather the scoped style sheets into an array as
+      // nsCSSStyleSheets, and mark all of their scope elements
+      // as scoped style roots.
+      nsTArray<nsCSSStyleSheet*> sheets(count);
+      for (int32_t i = 0; i < count; i++) {
+        nsRefPtr<nsCSSStyleSheet> sheet =
+          do_QueryObject(mSheets[eScopedDocSheet].ObjectAt(i));
+        sheets.AppendElement(sheet);
+
+        Element* scope = sheet->GetScopeElement();
+        scope->SetIsScopedStyleRoot();
+      }
+
+      // Sort the scoped style sheets so that those for the same scope are
+      // adjacent and that ancestor scopes come before descendent scopes.
+      SortStyleSheetsByScope(sheets);
+
+      uint32_t start = 0, end;
+      do {
+        // Find the range of style sheets with the same scope.
+        Element* scope = sheets[start]->GetScopeElement();
+        end = start + 1;
+        while (end < count && sheets[end]->GetScopeElement() == scope) {
+          end++;
+        }
+
+        scope->SetIsScopedStyleRoot();
+
+        // Create a rule processor for the scope.
+        nsTArray< nsRefPtr<nsCSSStyleSheet> > sheetsForScope;
+        sheetsForScope.AppendElements(sheets.Elements() + start, end - start);
+        mScopedDocSheetRuleProcessors.AppendElement
+          (new nsCSSRuleProcessor(sheetsForScope, uint8_t(aType), scope));
+
+        start = end;
+      } while (start < count);
+    }
+    return NS_OK;
+  }
   if (mSheets[aType].Count()) {
     switch (aType) {
       case eAgentSheet:
       case eUserSheet:
       case eDocSheet:
       case eOverrideSheet: {
-        // levels containing CSS stylesheets
+        // levels containing CSS stylesheets (apart from eScopedDocSheet)
         nsCOMArray<nsIStyleSheet>& sheets = mSheets[aType];
         nsTArray<nsRefPtr<nsCSSStyleSheet> > cssSheets(sheets.Count());
         for (int32_t i = 0, i_end = sheets.Count(); i < i_end; ++i) {
@@ -246,8 +381,8 @@ nsStyleSet::GatherRuleProcessors(sheetType aType)
           NS_ASSERTION(cssSheet, "not a CSS sheet");
           cssSheets.AppendElement(cssSheet);
         }
-        mRuleProcessors[aType] = new nsCSSRuleProcessor(cssSheets, 
-                                                        uint8_t(aType));
+        mRuleProcessors[aType] =
+          new nsCSSRuleProcessor(cssSheets, uint8_t(aType), nullptr);
       } break;
 
       default:
@@ -261,6 +396,15 @@ nsStyleSet::GatherRuleProcessors(sheetType aType)
   return NS_OK;
 }
 
+static bool
+IsScopedStyleSheet(nsIStyleSheet* aSheet)
+{
+  nsRefPtr<nsCSSStyleSheet> cssSheet = do_QueryObject(aSheet);
+  NS_ASSERTION(cssSheet, "expected aSheet to be an nsCSSStyleSheet");
+
+  return cssSheet->GetScopeElement();
+}
+
 nsresult
 nsStyleSet::AppendStyleSheet(sheetType aType, nsIStyleSheet *aSheet)
 {
@@ -376,18 +520,21 @@ nsStyleSet::AddDocStyleSheet(nsIStyleSheet* aSheet, nsIDocument* aDocument)
   NS_ASSERTION(aSheet->IsApplicable(),
                "Inapplicable sheet being placed in style set");
 
-  nsCOMArray<nsIStyleSheet>& docSheets = mSheets[eDocSheet];
+  sheetType type = IsScopedStyleSheet(aSheet) ?
+                     eScopedDocSheet :
+                     eDocSheet;
+  nsCOMArray<nsIStyleSheet>& sheets = mSheets[type];
 
-  docSheets.RemoveObject(aSheet);
+  sheets.RemoveObject(aSheet);
   nsStyleSheetService *sheetService = nsStyleSheetService::GetInstance();
 
   // lowest index first
   int32_t newDocIndex = aDocument->GetIndexOfStyleSheet(aSheet);
 
-  int32_t count = docSheets.Count();
+  int32_t count = sheets.Count();
   int32_t index;
   for (index = 0; index < count; index++) {
-    nsIStyleSheet* sheet = docSheets.ObjectAt(index);
+    nsIStyleSheet* sheet = sheets.ObjectAt(index);
     int32_t sheetDocIndex = aDocument->GetIndexOfStyleSheet(sheet);
     if (sheetDocIndex > newDocIndex)
       break;
@@ -402,15 +549,23 @@ nsStyleSet::AddDocStyleSheet(nsIStyleSheet* aSheet, nsIDocument* aDocument)
         sheet == aDocument->FirstAdditionalAuthorSheet()))
         break;
   }
-  if (!docSheets.InsertObjectAt(aSheet, index))
+  if (!sheets.InsertObjectAt(aSheet, index))
     return NS_ERROR_OUT_OF_MEMORY;
   if (!mBatching)
-    return GatherRuleProcessors(eDocSheet);
+    return GatherRuleProcessors(type);
 
-  mDirty |= 1 << eDocSheet;
+  mDirty |= 1 << type;
   return NS_OK;
 }
 
+nsresult
+nsStyleSet::RemoveDocStyleSheet(nsIStyleSheet *aSheet)
+{
+  nsRefPtr<nsCSSStyleSheet> cssSheet = do_QueryObject(aSheet);
+  bool isScoped = cssSheet && cssSheet->GetScopeElement();
+  return RemoveStyleSheet(isScoped ? eScopedDocSheet : eDocSheet, aSheet);
+}
+
 // Batching
 void
 nsStyleSet::BeginUpdate()
@@ -743,7 +898,7 @@ nsStyleSet::AssertNoCSSRules(nsRuleNode* aCurrLevelNode,
 // Enumerate the rules in a way that cares about the order of the rules.
 void
 nsStyleSet::FileRules(nsIStyleRuleProcessor::EnumFunc aCollectorFunc, 
-                      RuleProcessorData* aData, nsIContent* aContent,
+                      RuleProcessorData* aData, Element* aElement,
                       nsRuleWalker* aRuleWalker)
 {
   SAMPLE_LABEL("nsStyleSet", "FileRules");
@@ -775,7 +930,7 @@ nsStyleSet::FileRules(nsIStyleRuleProcessor::EnumFunc aCollectorFunc,
 
   aRuleWalker->SetLevel(eUserSheet, false, true);
   bool skipUserStyles =
-    aContent && aContent->IsInNativeAnonymousSubtree();
+    aElement && aElement->IsInNativeAnonymousSubtree();
   if (!skipUserStyles && mRuleProcessors[eUserSheet]) // NOTE: different
     (*aCollectorFunc)(mRuleProcessors[eUserSheet], aData);
   nsRuleNode* lastUserRN = aRuleWalker->CurrentNode();
@@ -788,21 +943,42 @@ nsStyleSet::FileRules(nsIStyleRuleProcessor::EnumFunc aCollectorFunc,
   
   aRuleWalker->SetLevel(eDocSheet, false, true);
   bool cutOffInheritance = false;
-  if (mBindingManager && aContent) {
+  if (mBindingManager && aElement) {
     // We can supply additional document-level sheets that should be walked.
     mBindingManager->WalkRules(aCollectorFunc,
                                static_cast<ElementDependentRuleProcessorData*>(aData),
                                &cutOffInheritance);
   }
-  if (!skipUserStyles && !cutOffInheritance &&
-      mRuleProcessors[eDocSheet]) // NOTE: different
+  if (!skipUserStyles && !cutOffInheritance && // NOTE: different
+      mRuleProcessors[eDocSheet])
     (*aCollectorFunc)(mRuleProcessors[eDocSheet], aData);
-  aRuleWalker->SetLevel(eStyleAttrSheet, false,
-                        aRuleWalker->GetCheckForImportantRules());
-  if (mRuleProcessors[eStyleAttrSheet])
-    (*aCollectorFunc)(mRuleProcessors[eStyleAttrSheet], aData);
   nsRuleNode* lastDocRN = aRuleWalker->CurrentNode();
   bool haveImportantDocRules = !aRuleWalker->GetCheckForImportantRules();
+  nsTArray<nsRuleNode*> lastScopedRNs;
+  nsTArray<bool> haveImportantScopedRules;
+  bool haveAnyImportantScopedRules = false;
+  if (!skipUserStyles && !cutOffInheritance &&
+      aElement && aElement->IsElementInStyleScope()) {
+    lastScopedRNs.SetLength(mScopedDocSheetRuleProcessors.Length());
+    haveImportantScopedRules.SetLength(mScopedDocSheetRuleProcessors.Length());
+    for (int32_t i = 0; i < mScopedDocSheetRuleProcessors.Length(); i++) {
+      aRuleWalker->SetLevel(eScopedDocSheet, false, true);
+      nsCSSRuleProcessor* processor =
+        static_cast<nsCSSRuleProcessor*>(mScopedDocSheetRuleProcessors[i].get());
+      aData->mScope = processor->GetScopeElement();
+      (*aCollectorFunc)(mScopedDocSheetRuleProcessors[i], aData);
+      lastScopedRNs[i] = aRuleWalker->CurrentNode();
+      haveImportantScopedRules[i] = !aRuleWalker->GetCheckForImportantRules();
+      haveAnyImportantScopedRules = haveAnyImportantScopedRules || haveImportantScopedRules[i];
+    }
+    aData->mScope = nullptr;
+  }
+  nsRuleNode* lastScopedRN = aRuleWalker->CurrentNode();
+  aRuleWalker->SetLevel(eStyleAttrSheet, false, true);
+  if (mRuleProcessors[eStyleAttrSheet])
+    (*aCollectorFunc)(mRuleProcessors[eStyleAttrSheet], aData);
+  nsRuleNode* lastStyleAttrRN = aRuleWalker->CurrentNode();
+  bool haveImportantStyleAttrRules = !aRuleWalker->GetCheckForImportantRules();
 
   aRuleWalker->SetLevel(eOverrideSheet, false, true);
   if (mRuleProcessors[eOverrideSheet])
@@ -814,6 +990,27 @@ nsStyleSet::FileRules(nsIStyleRuleProcessor::EnumFunc aCollectorFunc,
   aRuleWalker->SetLevel(eAnimationSheet, false, false);
   (*aCollectorFunc)(mRuleProcessors[eAnimationSheet], aData);
 
+  if (haveAnyImportantScopedRules) {
+    for (uint32_t i = lastScopedRNs.Length(); i-- != 0; ) {
+      aRuleWalker->SetLevel(eScopedDocSheet, true, false);
+      nsRuleNode* startRN = lastScopedRNs[i];
+      nsRuleNode* endRN = i == 0 ? lastDocRN : lastScopedRNs[i - 1];
+      if (haveImportantScopedRules[i]) {
+        AddImportantRules(startRN, endRN, aRuleWalker);  // scoped
+      }
+#ifdef DEBUG
+      else {
+        AssertNoImportantRules(startRN, endRN);
+      }
+#endif
+    }
+  }
+#ifdef DEBUG
+  else {
+    AssertNoImportantRules(lastScopedRN, lastDocRN);
+  }
+#endif
+
   if (haveImportantDocRules) {
     aRuleWalker->SetLevel(eDocSheet, true, false);
     AddImportantRules(lastDocRN, lastPresHintRN, aRuleWalker);  // doc
@@ -824,13 +1021,23 @@ nsStyleSet::FileRules(nsIStyleRuleProcessor::EnumFunc aCollectorFunc,
   }
 #endif
 
-  if (haveImportantOverrideRules) {
-    aRuleWalker->SetLevel(eOverrideSheet, true, false);
-    AddImportantRules(lastOvrRN, lastDocRN, aRuleWalker);  // override
+  if (haveImportantStyleAttrRules) {
+    aRuleWalker->SetLevel(eStyleAttrSheet, true, false);
+    AddImportantRules(lastStyleAttrRN, lastScopedRN, aRuleWalker);  // style attr
   }
 #ifdef DEBUG
   else {
-    AssertNoImportantRules(lastOvrRN, lastDocRN);
+    AssertNoImportantRules(lastStyleAttrRN, lastScopedRN);
+  }
+#endif
+
+  if (haveImportantOverrideRules) {
+    aRuleWalker->SetLevel(eOverrideSheet, true, false);
+    AddImportantRules(lastOvrRN, lastStyleAttrRN, aRuleWalker);  // override
+  }
+#ifdef DEBUG
+  else {
+    AssertNoImportantRules(lastOvrRN, lastStyleAttrRN);
   }
 #endif
 
@@ -899,9 +1106,14 @@ nsStyleSet::WalkRuleProcessors(nsIStyleRuleProcessor::EnumFunc aFunc,
       mBindingManager->WalkRules(aFunc, aData, &cutOffInheritance);
     }
   }
-  if (!skipUserStyles && !cutOffInheritance &&
-      mRuleProcessors[eDocSheet]) // NOTE: different
-    (*aFunc)(mRuleProcessors[eDocSheet], aData);
+  if (!skipUserStyles && !cutOffInheritance) {
+    if (mRuleProcessors[eDocSheet]) // NOTE: different
+      (*aFunc)(mRuleProcessors[eDocSheet], aData);
+    if (aData->mElement->IsElementInStyleScope()) {
+      for (int32_t i = 0; i < mScopedDocSheetRuleProcessors.Length(); i++)
+        (*aFunc)(mScopedDocSheetRuleProcessors[i], aData);
+    }
+  }
   if (mRuleProcessors[eStyleAttrSheet])
     (*aFunc)(mRuleProcessors[eStyleAttrSheet], aData);
   if (mRuleProcessors[eOverrideSheet])
@@ -1259,6 +1471,8 @@ nsStyleSet::AppendFontFaceRules(nsPresContext* aPresContext,
   NS_ENSURE_FALSE(mInShutdown, false);
 
   for (uint32_t i = 0; i < ArrayLength(gCSSSheetTypes); ++i) {
+    if (gCSSSheetTypes[i] == eScopedDocSheet)
+      continue;
     nsCSSRuleProcessor *ruleProc = static_cast<nsCSSRuleProcessor*>
                                     (mRuleProcessors[gCSSSheetTypes[i]].get());
     if (ruleProc && !ruleProc->AppendFontFaceRules(aPresContext, aArray))
@@ -1274,6 +1488,8 @@ nsStyleSet::AppendKeyframesRules(nsPresContext* aPresContext,
   NS_ENSURE_FALSE(mInShutdown, false);
 
   for (uint32_t i = 0; i < ArrayLength(gCSSSheetTypes); ++i) {
+    if (gCSSSheetTypes[i] == eScopedDocSheet)
+      continue;
     nsCSSRuleProcessor *ruleProc = static_cast<nsCSSRuleProcessor*>
                                     (mRuleProcessors[gCSSSheetTypes[i]].get());
     if (ruleProc && !ruleProc->AppendKeyframesRules(aPresContext, aArray))
@@ -1289,6 +1505,8 @@ nsStyleSet::AppendPageRules(nsPresContext* aPresContext,
   NS_ENSURE_FALSE(mInShutdown, false);
 
   for (uint32_t i = 0; i < NS_ARRAY_LENGTH(gCSSSheetTypes); ++i) {
+    if (gCSSSheetTypes[i] == eScopedDocSheet)
+      continue;
     nsCSSRuleProcessor* ruleProc = static_cast<nsCSSRuleProcessor*>
                                     (mRuleProcessors[gCSSSheetTypes[i]].get());
     if (ruleProc && !ruleProc->AppendPageRules(aPresContext, aArray))
diff --git a/layout/style/nsStyleSet.h b/layout/style/nsStyleSet.h
index 5bdb71f3aff9..bf4dac17c32a 100644
--- a/layout/style/nsStyleSet.h
+++ b/layout/style/nsStyleSet.h
@@ -233,6 +233,7 @@ class nsStyleSet
     eUserSheet, // CSS
     ePresHintSheet,
     eDocSheet, // CSS
+    eScopedDocSheet,
     eStyleAttrSheet,
     eOverrideSheet, // CSS
     eAnimationSheet,
@@ -253,7 +254,7 @@ class nsStyleSet
   nsresult InsertStyleSheetBefore(sheetType aType, nsIStyleSheet *aNewSheet,
                                   nsIStyleSheet *aReferenceSheet);
 
-  // Enable/Disable entire author style level (Doc & PresHint levels)
+  // Enable/Disable entire author style level (Doc, ScopedDoc & PresHint levels)
   bool GetAuthorStyleDisabled();
   nsresult SetAuthorStyleDisabled(bool aStyleDisabled);
 
@@ -265,6 +266,7 @@ class nsStyleSet
     return mSheets[aType].ObjectAt(aIndex);
   }
 
+  nsresult RemoveDocStyleSheet(nsIStyleSheet* aSheet);
   nsresult AddDocStyleSheet(nsIStyleSheet* aSheet, nsIDocument* aDocument);
 
   void     BeginUpdate();
@@ -342,11 +344,11 @@ class nsStyleSet
   
   // Enumerate the rules in a way that cares about the order of the
   // rules.
-  // aContent is the node the rules are for.  It might be null.  aData
+  // aElement is the element the rules are for.  It might be null.  aData
   // is the closure to pass to aCollectorFunc.  If aContent is not null,
   // aData must be a RuleProcessorData*
   void FileRules(nsIStyleRuleProcessor::EnumFunc aCollectorFunc,
-                 RuleProcessorData* aData, nsIContent* aContent,
+                 RuleProcessorData* aData, mozilla::dom::Element* aElement,
                  nsRuleWalker* aRuleWalker);
 
   // Enumerate all the rules in a way that doesn't care about the order
@@ -372,8 +374,13 @@ class nsStyleSet
   // sheet last.
   nsCOMArray<nsIStyleSheet> mSheets[eSheetTypeCount];
 
+  // mRuleProcessors[eScopedDocSheet] is always null; rule processors
+  // for scoped style sheets are stored in mScopedDocSheetRuleProcessors.
   nsCOMPtr<nsIStyleRuleProcessor> mRuleProcessors[eSheetTypeCount];
 
+  // Rule processors for HTML5 scoped style sheets, one per scope.
+  nsTArray<nsCOMPtr<nsIStyleRuleProcessor> > mScopedDocSheetRuleProcessors;
+
   // cached instance for enabling/disabling
   nsCOMPtr<nsIStyleSheet> mQuirkStyleSheet;
 
@@ -388,7 +395,7 @@ class nsStyleSet
   unsigned mInShutdown : 1;
   unsigned mAuthorStyleDisabled: 1;
   unsigned mInReconstruct : 1;
-  unsigned mDirty : 8;  // one dirty bit is used per sheet type
+  unsigned mDirty : 9;  // one dirty bit is used per sheet type
 
   uint32_t mUnusedRuleNodeCount; // used to batch rule node GC
   nsTArray<nsStyleContext*> mRoots; // style contexts with no parent
diff --git a/layout/style/nsTransitionManager.cpp b/layout/style/nsTransitionManager.cpp
index 420df168b84a..c0b413d0a05b 100644
--- a/layout/style/nsTransitionManager.cpp
+++ b/layout/style/nsTransitionManager.cpp
@@ -28,6 +28,7 @@
 #include "Layers.h"
 #include "FrameLayerBuilder.h"
 #include "nsDisplayList.h"
+#include "nsStyleChangeList.h"
 
 using mozilla::TimeStamp;
 using mozilla::TimeDuration;
@@ -251,7 +252,8 @@ ForceLayerRerendering(nsIFrame* aFrame, CommonElementAnimationData* aData)
 
 nsStyleContext*
 nsTransitionManager::UpdateThrottledStyle(dom::Element* aElement,
-                                          nsStyleContext* aParentStyle)
+                                          nsStyleContext* aParentStyle,
+                                          nsStyleChangeList& aChangeList)
 {
   NS_ASSERTION(GetElementTransitions(aElement,
                                      nsCSSPseudoElements::ePseudo_NotPseudoElement,
@@ -283,6 +285,7 @@ nsTransitionManager::UpdateThrottledStyle(dom::Element* aElement,
       mPresContext->AnimationManager()->EnsureStyleRuleFor(ea);
       curRule.mRule = ea->mStyleRule;
 
+      // FIXME: maybe not needed anymore:
       ForceLayerRerendering(primaryFrame, ea);
     } else if (curRule.mLevel == nsStyleSet::eTransitionSheet) {
       ElementTransitions *et =
@@ -292,6 +295,7 @@ nsTransitionManager::UpdateThrottledStyle(dom::Element* aElement,
       et->EnsureStyleRuleFor(mPresContext->RefreshDriver()->MostRecentRefresh());
       curRule.mRule = et->mStyleRule;
 
+      // FIXME: maybe not needed anymore:
       ForceLayerRerendering(primaryFrame, et);
     } else {
       curRule.mRule = ruleNode->GetRule();
@@ -304,6 +308,21 @@ nsTransitionManager::UpdateThrottledStyle(dom::Element* aElement,
 
   nsRefPtr<nsStyleContext> newStyle = mPresContext->PresShell()->StyleSet()->
     ResolveStyleForRules(aParentStyle, oldStyle, rules);
+
+  // We absolutely must call CalcStyleDifference in order to ensure the
+  // new context has all the structs cached that the old context had.
+  // We also need it for processing of the changes.
+  nsChangeHint styleChange =
+    oldStyle->CalcStyleDifference(newStyle, nsChangeHint(0));
+  // This isn't particularly dangerous, but I want to catch if it happens:
+  NS_ABORT_IF_FALSE(NS_IsHintSubset(styleChange,
+                                    NS_CombineHint(nsChangeHint_UpdateOpacityLayer,
+                                      NS_CombineHint(nsChangeHint_UpdateTransformLayer,
+                                                     nsChangeHint_UpdateOverflow))),
+                    "unexpected change hint");
+  aChangeList.AppendChange(primaryFrame, primaryFrame->GetContent(),
+                           styleChange);
+
   primaryFrame->SetStyleContextWithoutNotification(newStyle);
 
   ReparentBeforeAndAfter(aElement, primaryFrame, newStyle, mPresContext->PresShell()->StyleSet());
@@ -313,7 +332,8 @@ nsTransitionManager::UpdateThrottledStyle(dom::Element* aElement,
 
 void
 nsTransitionManager::UpdateThrottledStylesForSubtree(nsIContent* aContent,
-                                                     nsStyleContext* aParentStyle)
+                                                     nsStyleContext* aParentStyle,
+                                                     nsStyleChangeList& aChangeList)
 {
   dom::Element* element;
   if (aContent->IsElement()) {
@@ -330,7 +350,7 @@ nsTransitionManager::UpdateThrottledStylesForSubtree(nsIContent* aContent,
                                   nsCSSPseudoElements::ePseudo_NotPseudoElement,
                                   false))) {
     // re-resolve our style
-    newStyle = UpdateThrottledStyle(element, aParentStyle);
+    newStyle = UpdateThrottledStyle(element, aParentStyle, aChangeList);
     // remove the current transition from the working set
     et->mFlushGeneration = mPresContext->RefreshDriver()->MostRecentRefresh();
   } else {
@@ -351,7 +371,7 @@ nsTransitionManager::UpdateThrottledStylesForSubtree(nsIContent* aContent,
   if (newStyle) {
     for (nsIContent *child = aContent->GetFirstChild(); child;
          child = child->GetNextSibling()) {
-      UpdateThrottledStylesForSubtree(child, newStyle);
+      UpdateThrottledStylesForSubtree(child, newStyle, aChangeList);
     }
   }
 }
@@ -373,6 +393,8 @@ nsTransitionManager::UpdateAllThrottledStyles()
   mPresContext->TickLastUpdateThrottledStyle();
   TimeStamp now = mPresContext->RefreshDriver()->MostRecentRefresh();
 
+  nsStyleChangeList changeList;
+
   // update each transitioning element by finding its root-most ancestor with a
   // transition, and flushing the style on that ancestor and all its descendants
   PRCList *next = PR_LIST_HEAD(&mElementData);
@@ -409,9 +431,14 @@ nsTransitionManager::UpdateAllThrottledStyles()
     if (element &&
         (primaryFrame = element->GetPrimaryFrame())) {
       UpdateThrottledStylesForSubtree(element,
-        primaryFrame->GetStyleContext()->GetParent());
+        primaryFrame->GetStyleContext()->GetParent(), changeList);
     }
   }
+
+  OverflowChangedTracker tracker;
+  mPresContext->PresShell()->FrameConstructor()->
+    ProcessRestyledFrames(changeList, tracker);
+  tracker.Flush();
 }
 
 already_AddRefed<nsIStyleRule>
diff --git a/layout/style/nsTransitionManager.h b/layout/style/nsTransitionManager.h
index 05ee51baa54c..7446f645bb43 100644
--- a/layout/style/nsTransitionManager.h
+++ b/layout/style/nsTransitionManager.h
@@ -220,12 +220,14 @@ private:
   // If the element has a transition, it is flushed back to its primary frame.
   // If the element does not have a transition, then its style is reparented.
   void UpdateThrottledStylesForSubtree(nsIContent* aContent,
-                                       nsStyleContext* aParentStyle);
+                                       nsStyleContext* aParentStyle,
+                                       nsStyleChangeList &aChangeList);
   // Update the style on aElement from the transition stored in this manager and
   // the new parent style - aParentStyle. aElement must be transitioning or
   // animated. Returns the updated style.
   nsStyleContext* UpdateThrottledStyle(mozilla::dom::Element* aElement,
-                                       nsStyleContext* aParentStyle);
+                                       nsStyleContext* aParentStyle,
+                                       nsStyleChangeList &aChangeList);
 };
 
 #endif /* !defined(nsTransitionManager_h_) */
diff --git a/layout/style/test/Makefile.in b/layout/style/test/Makefile.in
index c98cb10a3856..50c9ee933c67 100644
--- a/layout/style/test/Makefile.in
+++ b/layout/style/test/Makefile.in
@@ -104,6 +104,7 @@ MOCHITEST_FILES =	test_acid3_test46.html \
 		test_descriptor_syntax_errors.html \
 		test_dont_use_document_colors.html \
 		test_font_face_parser.html \
+		test_font_family_parsing.html \
 		test_garbage_at_end_of_declarations.html \
 		test_html_attribute_computed_values.html \
 		test_ident_escaping.html \
diff --git a/layout/style/test/test_font_family_parsing.html b/layout/style/test/test_font_family_parsing.html
new file mode 100644
index 000000000000..ea7dffe7b083
--- /dev/null
+++ b/layout/style/test/test_font_family_parsing.html
@@ -0,0 +1,274 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <meta charset=utf-8>
+  <title>Font family name parsing tests</title>
+  <link rel="author" title="John Daggett" href="mailto:jdaggett@mozilla.com">
+  <link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-family-prop" />
+  <link rel="help" href="http://www.w3.org/TR/css3-fonts/#font-prop" />
+  <meta name="assert" content="tests that valid font family names parse and invalid ones don't" />
+  <script type="text/javascript" src="/resources/testharness.js"></script>
+  <script type="text/javascript" src="/resources/testharnessreport.js"></script>
+  <style type="text/css">
+  </style>
+</head>
+<body>
+<div id="log"></div>
+<pre id="display"></pre>
+<style type="text/css" id="testbox"></style>
+
+<script type="text/javascript">
+
+function fontProp(n, size, s1, s2) { return (s1 ? s1 + " " : "") + (s2 ? s2 + " " : "") + size + " " + n; }
+function font(n, size, s1, s2) { return "font: " + fontProp(n, size, s1, s2); }
+ 
+// testrules
+//   namelist - font family list
+//   invalid  - true if declarations won't parse in either font-family or font
+//   fontonly - only test with the 'font' property
+//   single   - namelist includes only a single name (@font-face rules only allow a single name)
+
+var testFontFamilyLists = [
+
+  /* basic syntax */
+  { namelist: "simple", single: true },
+  { namelist: "'simple'", single: true },
+  { namelist: '"simple"', single: true },
+  { namelist: "-simple", single: true },
+  { namelist: "_simple", single: true },
+  { namelist: "quite simple", single: true },
+  { namelist: "quite _simple", single: true },
+  { namelist: "quite -simple", single: true },
+  { namelist: "0simple", invalid: true, single: true },
+  { namelist: "simple!", invalid: true, single: true },
+  { namelist: "simple()", invalid: true, single: true },
+  { namelist: "quite@simple", invalid: true, single: true },
+  { namelist: "#simple", invalid: true, single: true },
+  { namelist: "quite 0simple", invalid: true, single: true },
+  { namelist: "納豆嫌い", single: true },
+  { namelist: "納豆嫌い, ick, patooey" },
+  { namelist: "ick, patooey, 納豆嫌い" },
+  { namelist: "納豆嫌い, 納豆大嫌い" },
+  { namelist: "納豆嫌い, 納豆大嫌い, 納豆本当に嫌い" },
+  { namelist: "納豆嫌い, 納豆大嫌い, 納豆本当に嫌い, 納豆は好みではない" },
+  { namelist: "arial, helvetica, sans-serif" },
+  { namelist: "arial, helvetica, 'times' new roman, sans-serif", invalid: true },
+  { namelist: "arial, helvetica, \"times\" new roman, sans-serif", invalid: true },
+
+  // bug 660397 - quotes contained within family names are not escaped
+  // { namelist: "arial, helvetica, \"\\\"times new roman\", sans-serif" },
+  { namelist: "arial, helvetica, '\\\"times new roman', sans-serif" },
+  { namelist: "arial, helvetica, times 'new' roman, sans-serif", invalid: true },
+  { namelist: "arial, helvetica, times \"new\" roman, sans-serif", invalid: true },
+  // { namelist: "\"simple", invalid: true, single: true },
+  // { namelist: "\\\"simple", single: true },
+  // { namelist: "\"\\\"simple\"", single: true },
+  { namelist: "İsimple", single: true },
+  { namelist: "ßsimple", single: true },
+  { namelist: "ẙsimple", single: true },
+
+  /* escapes */
+  { namelist: "\\s imple", single: true },
+  { namelist: "\\073 imple", single: true },
+
+  // bug 475216 - css serialization doesn't escape characters that need escaping
+  // { namelist: "\\035 simple", single: true },
+  { namelist: "sim\\035 ple", single: true },
+  // { namelist: "simple\\02cinitial", single: true },
+  // { namelist: "simple, \\02cinitial" },
+  // { namelist: "sim\\020 \\035 ple", single: true },
+  // { namelist: "sim\\020 5ple", single: true },
+  // { namelist: "\\;", single: true },
+  // { namelist: "\\;,\\;", single: true },
+  // { namelist: "\\,\\;", single: true },
+  // { namelist: "\\{", single: true },
+  // { namelist: "\\{\\;", single: true },
+  // { namelist: "\\}", single: true },
+  // { namelist: "\\}\\;", single: true },
+  // { namelist: "\\@simple", single: true },
+  // { namelist: "\\@simple\\;", single: true },
+  // { namelist: "\\@font-face", single: true },
+  // { namelist: "\\@font-face\\;", single: true },
+  // { namelist: "\\031 \\036 px", single: true },
+  // { namelist: "\\031 \\036 px", single: true },
+  { namelist: "\\1f4a9", single: true },
+  { namelist: "\\01f4a9", single: true },
+  { namelist: "\\0001f4a9", single: true },
+  { namelist: "\\AbAb", single: true },
+
+  /* keywords */
+  { namelist: "italic", single: true },
+  { namelist: "bold", single: true },
+  { namelist: "bold italic", single: true },
+  { namelist: "italic bold", single: true },
+  { namelist: "larger", single: true },
+  { namelist: "smaller", single: true },
+  { namelist: "bolder", single: true },
+  { namelist: "lighter", single: true },
+  { namelist: "default", invalid: true, fontonly: true, single: true },
+  { namelist: "initial", invalid: true, fontonly: true, single: true },
+  { namelist: "inherit", invalid: true, fontonly: true, single: true },
+  { namelist: "normal", single: true },
+  { namelist: "default, simple", invalid: true },
+  { namelist: "initial, simple", invalid: true },
+  { namelist: "inherit, simple", invalid: true },
+  { namelist: "normal, simple" },
+  { namelist: "simple, default", invalid: true },
+  { namelist: "simple, initial", invalid: true },
+  { namelist: "simple, inherit", invalid: true },
+  { namelist: "simple, default bongo" },
+  { namelist: "simple, initial bongo" },
+  { namelist: "simple, inherit bongo" },
+  { namelist: "simple, bongo default" },
+  { namelist: "simple, bongo initial" },
+  { namelist: "simple, bongo inherit" },
+  { namelist: "simple, normal" },
+  { namelist: "simple default", single: true },
+  { namelist: "simple initial", single: true },
+  { namelist: "simple inherit", single: true },
+  { namelist: "simple normal", single: true },
+  { namelist: "default simple", single: true },
+  { namelist: "initial simple", single: true },
+  { namelist: "inherit simple", single: true },
+  { namelist: "normal simple", single: true },
+  { namelist: "caption", single: true }, // these are keywords for the 'font' property but only when in the first position
+  { namelist: "icon", single: true },
+  { namelist: "menu", single: true }
+
+];
+
+var gTest = 0;
+
+/* strip out just values */
+function extractDecl(rule)
+{
+  var t = rule.replace(/[ \n]+/g, " ");
+  t = t.replace(/.*{[ \n]*/, "");
+  t = t.replace(/[ \n]*}.*/, "");
+  return t;
+}
+
+
+function testStyleRuleParse(decl, invalid) {
+  var sheet = document.styleSheets[1];
+  var rule = ".test" + gTest++ + " { " + decl + "; }";
+
+  while(sheet.cssRules.length > 0) {
+    sheet.deleteRule(0);
+  }
+
+  // shouldn't throw but improper handling of punctuation may cause some parsers to throw
+  try {
+    sheet.insertRule(rule, 0);
+  } catch (e) {
+    assert_unreached("unexpected error with " + decl + " ==> " + e.name);
+  }
+
+  assert_equals(sheet.cssRules.length, 1, 
+    "strange number of rules (" + sheet.cssRules.length + ") with " + decl);
+
+  var s = extractDecl(sheet.cssRules[0].cssText);
+
+  if (invalid) {
+    assert_equals(s, "", "rule declaration shouldn't parse - " + rule + " ==> " + s);
+  } else {
+    assert_not_equals(s, "", "rule declaration should parse - " + rule);
+    
+    // check that the serialization also parses
+    var r = ".test" + gTest++ + " { " + s + " }";
+    while(sheet.cssRules.length > 0) {
+      sheet.deleteRule(0);
+    }
+    try {
+      sheet.insertRule(r, 0);
+    } catch (e) {
+      assert_unreached("exception occurred parsing serialized form of rule - " + rule + " ==> " + r + " " + e.name);
+    }
+    var s2 = extractDecl(sheet.cssRules[0].cssText);
+    assert_not_equals(s2, "", "serialized form of rule should also parse - " + rule + " ==> " + r);
+  }
+}
+
+var kDefaultFamilySetting = "onelittlepiggywenttomarket";
+
+function testFontFamilySetterParse(namelist, invalid) {
+  var el = document.getElementById("display");
+
+  el.style.fontFamily = kDefaultFamilySetting;
+  var def = el.style.fontFamily;
+  el.style.fontFamily = namelist;
+  if (!invalid) {
+    assert_not_equals(el.style.fontFamily, def, "fontFamily setter should parse - " + namelist);
+    var parsed = el.style.fontFamily;
+    el.style.fontFamily = kDefaultFamilySetting;
+    el.style.fontFamily = parsed;
+    assert_equals(el.style.fontFamily, parsed, "fontFamily setter should parse serialized form to identical serialization - " + parsed + " ==> " + el.style.fontFamily);
+  } else {
+    assert_equals(el.style.fontFamily, def, "fontFamily setter shouldn't parse - " + namelist);
+  }
+}
+
+var kDefaultFontSetting = "16px onelittlepiggywenttomarket";
+
+function testFontSetterParse(n, size, s1, s2, invalid) {
+  var el = document.getElementById("display");
+
+  el.style.font = kDefaultFontSetting;
+  var def = el.style.font;
+  var fp = fontProp(n, size, s1, s2);
+  el.style.font = fp;
+  if (!invalid) {
+    assert_not_equals(el.style.font, def, "font setter should parse - " + fp);
+    var parsed = el.style.font;
+    el.style.font = kDefaultFontSetting;
+    el.style.font = parsed;
+    assert_equals(el.style.font, parsed, "font setter should parse serialized form to identical serialization - " + parsed + " ==> " + el.style.font);
+  } else {
+    assert_equals(el.style.font, def, "font setter shouldn't parse - " + fp);
+  }
+}
+
+var testFontVariations = [
+  { size: "16px" },
+  { size: "900px" },
+  { size: "900em" },
+  { size: "35%" },
+  { size: "7832.3%" },
+  { size: "xx-large" },
+  { size: "larger", s1: "lighter" },
+  { size: "16px", s1: "italic" },
+  { size: "16px", s1: "italic", s2: "bold" },
+  { size: "smaller", s1: "normal" },
+  { size: "16px", s1: "normal", s2: "normal" },
+  { size: "16px", s1: "400", s2: "normal" },
+  { size: "16px", s1: "bolder", s2: "oblique" }
+];
+
+function testFamilyNameParsing() {
+  var i;
+  for (i = 0; i < testFontFamilyLists.length; i++) {
+    var tst = testFontFamilyLists[i];
+    var n = tst.namelist;
+    var t;
+
+    if (!tst.fontonly) {
+      t = "font-family: " + n;
+      test(function() { testStyleRuleParse(t, tst.invalid); }, t);
+      test(function() { testFontFamilySetterParse(n, tst.invalid); }, t + " (setter)");
+    }
+
+    var v;
+    for (v = 0; v < testFontVariations.length; v++) {
+      var f = testFontVariations[v];
+      t = font(n, f.size, f.s1, f.s2);
+      test(function() { testStyleRuleParse(t, tst.invalid); }, t);
+      test(function() { testFontSetterParse(n, f.size, f.s1, f.s2, tst.invalid); }, t + " (setter)");
+    }
+  }
+}
+
+testFamilyNameParsing();
+
+</script>
+</body>
+</html>
diff --git a/layout/style/test/test_garbage_at_end_of_declarations.html b/layout/style/test/test_garbage_at_end_of_declarations.html
index 4042cc32ffe5..c9c8dd757618 100644
--- a/layout/style/test/test_garbage_at_end_of_declarations.html
+++ b/layout/style/test/test_garbage_at_end_of_declarations.html
@@ -71,6 +71,7 @@ var gAllowsExtraUnusual = {
                  "ease-in-out": true, "2s ease-in": true,
                  "ease-out 2s": true, "1s bounce, 2s": true,
                  "1s bounce, 2s none": true },
+  "font-family": { "inherit": true, "initial": true }
 };
 
 gAllowsExtraUnusual["-moz-transition"] = gAllowsExtraUnusual["transition"];
diff --git a/layout/style/test/test_transitions_per_property.html b/layout/style/test/test_transitions_per_property.html
index b0c8fb34e49e..88f2d0ea3b28 100644
--- a/layout/style/test/test_transitions_per_property.html
+++ b/layout/style/test/test_transitions_per_property.html
@@ -49,6 +49,7 @@ function any_unit_to_num(str)
 }
 
 var FUNC_NEGATIVE = "cubic-bezier(0.25, -2, 0.75, 1)";
+var FUNC_OVERONE = "cubic-bezier(0.25, 0, 0.75, 3)";
 
 var supported_properties = {
     "border-bottom-left-radius": [ test_radius_transition ],
@@ -1131,38 +1132,74 @@ function test_rect_transition(prop) {
 }
 
 function test_visibility_transition(prop) {
-  div.style.setProperty("transition-property", "none", "");
-  div.style.setProperty(prop, "visible", "");
-  is(cs.getPropertyValue(prop), "visible",
-     "visibility property " + prop + ": computed value before transition");
-  div.style.setProperty("transition-property", prop, "");
-  div.style.setProperty(prop, "hidden", "");
-  is(cs.getPropertyValue(prop), "visible",
-     "visibility property " + prop + ": interpolation of visibility");
+  function do_test(from_value, to_value, interp_value) {
+    div.style.setProperty("transition-property", "none", "");
+    div.style.setProperty(prop, from_value, "");
+    is(cs.getPropertyValue(prop), from_value,
+       "visibility property " + prop + ": computed value before transition");
+    div.style.setProperty("transition-property", prop, "");
+    div.style.setProperty(prop, to_value, "");
+    is(cs.getPropertyValue(prop), interp_value,
+       "visibility property " + prop + ": interpolation of visibility");
+  }
+
+  do_test("visible", "hidden", "visible");
+  do_test("hidden", "visible", "visible");
+  do_test("hidden", "collapse", "collapse"); /* not interpolable */
+  do_test("collapse", "hidden", "hidden"); /* not interpolable */
+  do_test("visible", "collapse", "visible");
+  do_test("collapse", "visible", "visible");
+
   isnot(get_distance(prop, "visible", "hidden"), 0,
         "distance between visible and hidden should not be zero");
+  isnot(get_distance(prop, "visible", "collapse"), 0,
+        "distance between visible and collapse should not be zero");
   is(get_distance(prop, "visible", "visible"), 0,
      "distance between visible and visible should not be zero");
   is(get_distance(prop, "hidden", "hidden"), 0,
      "distance between hidden and hidden should not be zero");
+  is(get_distance(prop, "collapse", "collapse"), 0,
+     "distance between collapse and collapse should not be zero");
 
   div.style.setProperty("transition-timing-function", FUNC_NEGATIVE, "");
-  div.style.setProperty("transition-property", "none", "");
-  div.style.setProperty(prop, "visible", "");
-  is(cs.getPropertyValue(prop), "visible",
-     "visibility property " + prop + ": flush before clamping test");
-  div.style.setProperty("transition-property", prop, "");
-  div.style.setProperty(prop, "hidden", "");
-  is(cs.getPropertyValue(prop), "visible",
-     "visibility property " + prop + ": clamping of negatives");
-  div.style.setProperty("transition-property", "none", "");
-  div.style.setProperty(prop, "hidden", "");
-  is(cs.getPropertyValue(prop), "hidden",
-     "visibility property " + prop + ": flush before clamping test");
-  div.style.setProperty("transition-property", prop, "");
-  div.style.setProperty(prop, "visible", "");
-  is(cs.getPropertyValue(prop), "hidden",
-     "visibility property " + prop + ": clamping of negatives");
+  function do_negative_test(from_value, to_value, interpolable) {
+    div.style.setProperty("transition-property", "none", "");
+    div.style.setProperty(prop, from_value, "");
+    is(cs.getPropertyValue(prop), from_value,
+       "visibility property " + prop + ": flush before clamping test");
+    div.style.setProperty("transition-property", prop, "");
+    div.style.setProperty(prop, to_value, "");
+    is(cs.getPropertyValue(prop), interpolable ? from_value : to_value,
+       "visibility property " + prop + ": clamping of negatives");
+  }
+  do_negative_test("visible", "hidden", true);
+  do_negative_test("hidden", "visible", true);
+  do_negative_test("hidden", "collapse", false);
+  do_negative_test("collapse", "hidden", false);
+  do_negative_test("visible", "collapse", true);
+  do_negative_test("collapse", "visible", true);
+
+  div.style.setProperty("transition-delay", "-3s", "");
+  div.style.setProperty("transition-timing-function", FUNC_OVERONE, "");
+
+  function do_overone_test(from_value, to_value) {
+    div.style.setProperty("transition-property", "none", "");
+    div.style.setProperty(prop, from_value, "");
+    is(cs.getPropertyValue(prop), from_value,
+       "visibility property " + prop + ": flush before clamping test");
+    div.style.setProperty("transition-property", prop, "");
+    div.style.setProperty(prop, to_value, "");
+    is(cs.getPropertyValue(prop), to_value,
+       "visibility property " + prop + ": clamping of over-ones");
+  }
+  do_overone_test("visible", "hidden");
+  do_overone_test("hidden", "visible");
+  do_overone_test("hidden", "collapse");
+  do_overone_test("collapse", "hidden");
+  do_overone_test("visible", "collapse");
+  do_overone_test("collapse", "visible");
+
+  div.style.setProperty("transition-delay", "-1s", "");
   div.style.setProperty("transition-timing-function", "linear", "");
 }
 
diff --git a/layout/svg/SVGFEImageFrame.cpp b/layout/svg/SVGFEImageFrame.cpp
index 79fed0c165c8..7d5140dd00d9 100644
--- a/layout/svg/SVGFEImageFrame.cpp
+++ b/layout/svg/SVGFEImageFrame.cpp
@@ -98,12 +98,9 @@ SVGFEImageFrame::Init(nsIContent* aContent,
                         nsIFrame* aParent,
                         nsIFrame* aPrevInFlow)
 {
-#ifdef DEBUG
-  nsCOMPtr<nsIDOMSVGFEImageElement> elem = do_QueryInterface(aContent);
-  NS_ASSERTION(elem,
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::feImage),
                "Trying to construct an SVGFEImageFrame for a "
                "content element that doesn't support the right interfaces");
-#endif /* DEBUG */
 
   SVGFEImageFrameBase::Init(aContent, aParent, aPrevInFlow);
   nsCOMPtr<nsIImageLoadingContent> imageLoader =
diff --git a/layout/svg/SVGViewFrame.cpp b/layout/svg/SVGViewFrame.cpp
index 7fc41443f73a..ad42d6b74b97 100644
--- a/layout/svg/SVGViewFrame.cpp
+++ b/layout/svg/SVGViewFrame.cpp
@@ -8,7 +8,7 @@
 #include "nsGkAtoms.h"
 #include "nsSVGOuterSVGFrame.h"
 #include "nsSVGSVGElement.h"
-#include "nsSVGViewElement.h"
+#include "mozilla/dom/SVGViewElement.h"
 
 typedef nsFrame SVGViewFrameBase;
 
@@ -81,8 +81,8 @@ SVGViewFrame::Init(nsIContent* aContent,
                    nsIFrame* aParent,
                    nsIFrame* aPrevInFlow)
 {
-  nsCOMPtr<nsIDOMSVGViewElement> elem = do_QueryInterface(aContent);
-  NS_ASSERTION(elem, "Content is not an SVG view");
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::view),
+               "Content is not an SVG view");
 
   return SVGViewFrameBase::Init(aContent, aParent, aPrevInFlow);
 }
diff --git a/layout/svg/nsSVGAFrame.cpp b/layout/svg/nsSVGAFrame.cpp
index ffdaf2fa6e5d..6ff9c54973bb 100644
--- a/layout/svg/nsSVGAFrame.cpp
+++ b/layout/svg/nsSVGAFrame.cpp
@@ -91,8 +91,7 @@ nsSVGAFrame::Init(nsIContent* aContent,
                   nsIFrame* aParent,
                   nsIFrame* aPrevInFlow)
 {
-  nsCOMPtr<nsIDOMSVGAElement> elem = do_QueryInterface(aContent);
-  NS_ASSERTION(elem,
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::a),
                "Trying to construct an SVGAFrame for a "
                "content element that doesn't support the right interfaces");
 
diff --git a/layout/svg/nsSVGClipPathFrame.cpp b/layout/svg/nsSVGClipPathFrame.cpp
index 01e8d66d46c3..af0a64f96640 100644
--- a/layout/svg/nsSVGClipPathFrame.cpp
+++ b/layout/svg/nsSVGClipPathFrame.cpp
@@ -9,7 +9,6 @@
 // Keep others in (case-insensitive) order:
 #include "gfxContext.h"
 #include "nsGkAtoms.h"
-#include "nsIDOMSVGClipPathElement.h"
 #include "nsRenderingContext.h"
 #include "nsSVGClipPathElement.h"
 #include "nsSVGEffects.h"
@@ -298,10 +297,8 @@ nsSVGClipPathFrame::Init(nsIContent* aContent,
                          nsIFrame* aParent,
                          nsIFrame* aPrevInFlow)
 {
-#ifdef DEBUG
-  nsCOMPtr<nsIDOMSVGClipPathElement> clipPath = do_QueryInterface(aContent);
-  NS_ASSERTION(clipPath, "Content is not an SVG clipPath!");
-#endif
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::clipPath),
+               "Content is not an SVG clipPath!");
 
   AddStateBits(NS_STATE_SVG_CLIPPATH_CHILD);
   return nsSVGClipPathFrameBase::Init(aContent, aParent, aPrevInFlow);
diff --git a/layout/svg/nsSVGFilterFrame.cpp b/layout/svg/nsSVGFilterFrame.cpp
index 7ba89b4de107..4e4d7bd6da99 100644
--- a/layout/svg/nsSVGFilterFrame.cpp
+++ b/layout/svg/nsSVGFilterFrame.cpp
@@ -523,15 +523,15 @@ nsSVGFilterFrame::GetPostFilterBounds(nsIFrame *aFilteredFrame,
   }
   return nsRect();
 }
-  
+
 #ifdef DEBUG
 NS_IMETHODIMP
 nsSVGFilterFrame::Init(nsIContent* aContent,
                        nsIFrame* aParent,
                        nsIFrame* aPrevInFlow)
 {
-  nsCOMPtr<nsIDOMSVGFilterElement> filter = do_QueryInterface(aContent);
-  NS_ASSERTION(filter, "Content is not an SVG filter");
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::filter),
+               "Content is not an SVG filter");
 
   return nsSVGFilterFrameBase::Init(aContent, aParent, aPrevInFlow);
 }
diff --git a/layout/svg/nsSVGForeignObjectFrame.cpp b/layout/svg/nsSVGForeignObjectFrame.cpp
index a25a8c357a56..db698451abfd 100644
--- a/layout/svg/nsSVGForeignObjectFrame.cpp
+++ b/layout/svg/nsSVGForeignObjectFrame.cpp
@@ -10,7 +10,6 @@
 #include "gfxContext.h"
 #include "gfxMatrix.h"
 #include "nsGkAtoms.h"
-#include "nsIDOMSVGForeignObjectElem.h"
 #include "nsINameSpaceManager.h"
 #include "nsLayoutUtils.h"
 #include "nsRegion.h"
@@ -58,10 +57,8 @@ nsSVGForeignObjectFrame::Init(nsIContent* aContent,
                               nsIFrame*   aParent,
                               nsIFrame*   aPrevInFlow)
 {
-#ifdef DEBUG
-  nsCOMPtr<nsIDOMSVGForeignObjectElement> foreignObject = do_QueryInterface(aContent);
-  NS_ASSERTION(foreignObject, "Content is not an SVG foreignObject!");
-#endif
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::foreignObject),
+               "Content is not an SVG foreignObject!");
 
   nsresult rv = nsSVGForeignObjectFrameBase::Init(aContent, aParent, aPrevInFlow);
   AddStateBits(aParent->GetStateBits() &
diff --git a/layout/svg/nsSVGGlyphFrame.cpp b/layout/svg/nsSVGGlyphFrame.cpp
index ee363b1c60af..9c9ed59ab04b 100644
--- a/layout/svg/nsSVGGlyphFrame.cpp
+++ b/layout/svg/nsSVGGlyphFrame.cpp
@@ -972,9 +972,6 @@ nsSVGGlyphFrame::SetupCairoStroke(gfxContext *aContext,
     return false;
   }
 
-  gfxContextMatrixAutoSaveRestore matrixRestore(aContext);
-  aContext->IdentityMatrix();
-
   nsSVGUtils::SetupCairoStrokeHitGeometry(this, aContext, aOuterObjectPaint);
   float opacity = nsSVGUtils::GetOpacity(style->mStrokeOpacitySource,
                                          style->mStrokeOpacity,
diff --git a/layout/svg/nsSVGGradientFrame.cpp b/layout/svg/nsSVGGradientFrame.cpp
index 52feb638f84c..efb59103e191 100644
--- a/layout/svg/nsSVGGradientFrame.cpp
+++ b/layout/svg/nsSVGGradientFrame.cpp
@@ -10,12 +10,13 @@
 #include "gfxPattern.h"
 #include "nsContentUtils.h"
 #include "nsIDOMSVGAnimatedNumber.h"
-#include "nsIDOMSVGStopElement.h"
 #include "nsSVGEffects.h"
 #include "nsSVGGradientElement.h"
 #include "SVGAnimatedTransformList.h"
+#include "mozilla/dom/SVGStopElement.h"
 
-using mozilla::SVGAnimatedTransformList;
+using namespace mozilla;
+using namespace mozilla::dom;
 
 //----------------------------------------------------------------------
 // Helper classes
@@ -103,12 +104,14 @@ nsSVGGradientFrame::GetStopInformation(int32_t aIndex,
 
   nsIFrame *stopFrame = nullptr;
   GetStopFrame(aIndex, &stopFrame);
-  nsCOMPtr<nsIDOMSVGStopElement> stopElement =
-    do_QueryInterface(stopFrame->GetContent());
 
-  if (stopElement) {
-    nsCOMPtr<nsIDOMSVGAnimatedNumber> aNum;
-    stopElement->GetOffset(getter_AddRefs(aNum));
+  nsIContent* stopContent = stopFrame->GetContent();
+
+  if (stopContent) {
+    MOZ_ASSERT(stopContent->IsSVG(nsGkAtoms::stop));
+    SVGStopElement* stopElement = nullptr;
+    stopElement = static_cast<SVGStopElement*>(stopContent);
+    nsCOMPtr<nsIDOMSVGAnimatedNumber> aNum = stopElement->Offset();
 
     aNum->GetAnimVal(aOffset);
     if (*aOffset < 0.0f)
@@ -419,8 +422,8 @@ nsSVGLinearGradientFrame::Init(nsIContent* aContent,
                                nsIFrame* aParent,
                                nsIFrame* aPrevInFlow)
 {
-  nsCOMPtr<nsIDOMSVGLinearGradientElement> grad = do_QueryInterface(aContent);
-  NS_ASSERTION(grad, "Content is not an SVG linearGradient");
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::linearGradient),
+               "Content is not an SVG linearGradient");
 
   return nsSVGLinearGradientFrameBase::Init(aContent, aParent, aPrevInFlow);
 }
@@ -532,8 +535,8 @@ nsSVGRadialGradientFrame::Init(nsIContent* aContent,
                                nsIFrame* aParent,
                                nsIFrame* aPrevInFlow)
 {
-  nsCOMPtr<nsIDOMSVGRadialGradientElement> grad = do_QueryInterface(aContent);
-  NS_ASSERTION(grad, "Content is not an SVG radialGradient");
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::radialGradient),
+               "Content is not an SVG radialGradient");
 
   return nsSVGRadialGradientFrameBase::Init(aContent, aParent, aPrevInFlow);
 }
diff --git a/layout/svg/nsSVGImageFrame.cpp b/layout/svg/nsSVGImageFrame.cpp
index 4fed47425e33..312cc7fb3f41 100644
--- a/layout/svg/nsSVGImageFrame.cpp
+++ b/layout/svg/nsSVGImageFrame.cpp
@@ -8,7 +8,6 @@
 #include "gfxMatrix.h"
 #include "gfxPlatform.h"
 #include "imgIContainer.h"
-#include "nsIDOMSVGImageElement.h"
 #include "nsIImageLoadingContent.h"
 #include "nsLayoutUtils.h"
 #include "nsRenderingContext.h"
@@ -133,14 +132,12 @@ nsSVGImageFrame::Init(nsIContent* aContent,
                       nsIFrame* aParent,
                       nsIFrame* aPrevInFlow)
 {
-#ifdef DEBUG
-  nsCOMPtr<nsIDOMSVGImageElement> image = do_QueryInterface(aContent);
-  NS_ASSERTION(image, "Content is not an SVG image!");
-#endif
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::image),
+               "Content is not an SVG image!");
 
   nsresult rv = nsSVGImageFrameBase::Init(aContent, aParent, aPrevInFlow);
   if (NS_FAILED(rv)) return rv;
-  
+
   mListener = new nsSVGImageListener(this);
   if (!mListener) return NS_ERROR_OUT_OF_MEMORY;
   nsCOMPtr<nsIImageLoadingContent> imageLoader = do_QueryInterface(mContent);
diff --git a/layout/svg/nsSVGInnerSVGFrame.cpp b/layout/svg/nsSVGInnerSVGFrame.cpp
index 40d1360411a5..a4e1ad38177c 100644
--- a/layout/svg/nsSVGInnerSVGFrame.cpp
+++ b/layout/svg/nsSVGInnerSVGFrame.cpp
@@ -37,8 +37,8 @@ nsSVGInnerSVGFrame::Init(nsIContent* aContent,
                          nsIFrame* aParent,
                          nsIFrame* aPrevInFlow)
 {
-  nsCOMPtr<nsIDOMSVGSVGElement> svg = do_QueryInterface(aContent);
-  NS_ASSERTION(svg, "Content is not an SVG 'svg' element!");
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::svg),
+               "Content is not an SVG 'svg' element!");
 
   return nsSVGInnerSVGFrameBase::Init(aContent, aParent, aPrevInFlow);
 }
diff --git a/layout/svg/nsSVGIntegrationUtils.cpp b/layout/svg/nsSVGIntegrationUtils.cpp
index b000634b1a60..aa99674dc45d 100644
--- a/layout/svg/nsSVGIntegrationUtils.cpp
+++ b/layout/svg/nsSVGIntegrationUtils.cpp
@@ -356,8 +356,13 @@ nsSVGIntegrationUtils::HitTestFrameForEffects(nsIFrame* aFrame, const nsPoint& a
   nsIFrame* firstFrame =
     nsLayoutUtils::GetFirstContinuationOrSpecialSibling(aFrame);
   // Convert aPt to user space:
-  nsPoint toUserSpace =
-    aFrame->GetOffsetTo(firstFrame) + GetOffsetToUserSpace(firstFrame);
+  nsPoint toUserSpace;
+  if (aFrame->GetStateBits() & NS_FRAME_SVG_LAYOUT) {
+    toUserSpace = aFrame->GetPosition();
+  } else {
+    toUserSpace =
+      aFrame->GetOffsetTo(firstFrame) + GetOffsetToUserSpace(firstFrame);
+  }
   nsPoint pt = aPt + toUserSpace;
   return nsSVGUtils::HitTestClip(firstFrame, pt);
 }
diff --git a/layout/svg/nsSVGMaskFrame.cpp b/layout/svg/nsSVGMaskFrame.cpp
index c5113385de6b..05dd0cc636dc 100644
--- a/layout/svg/nsSVGMaskFrame.cpp
+++ b/layout/svg/nsSVGMaskFrame.cpp
@@ -183,8 +183,8 @@ nsSVGMaskFrame::Init(nsIContent* aContent,
                      nsIFrame* aParent,
                      nsIFrame* aPrevInFlow)
 {
-  nsCOMPtr<nsIDOMSVGMaskElement> mask = do_QueryInterface(aContent);
-  NS_ASSERTION(mask, "Content is not an SVG mask");
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::mask),
+               "Content is not an SVG mask");
 
   return nsSVGMaskFrameBase::Init(aContent, aParent, aPrevInFlow);
 }
diff --git a/layout/svg/nsSVGOuterSVGFrame.cpp b/layout/svg/nsSVGOuterSVGFrame.cpp
index 7fd623293f73..e2c734985359 100644
--- a/layout/svg/nsSVGOuterSVGFrame.cpp
+++ b/layout/svg/nsSVGOuterSVGFrame.cpp
@@ -11,7 +11,6 @@
 #include "gfxMatrix.h"
 #include "nsDisplayList.h"
 #include "nsIDocument.h"
-#include "nsIDOMSVGSVGElement.h"
 #include "nsIDOMWindow.h"
 #include "nsIInterfaceRequestorUtils.h"
 #include "nsIObjectLoadingContent.h"
@@ -21,7 +20,7 @@
 #include "nsSVGForeignObjectFrame.h"
 #include "nsSVGSVGElement.h"
 #include "nsSVGTextFrame.h"
-#include "nsSVGViewElement.h"
+#include "mozilla/dom/SVGViewElement.h"
 #include "nsSubDocumentFrame.h"
 
 namespace dom = mozilla::dom;
@@ -150,10 +149,8 @@ nsSVGOuterSVGFrame::Init(nsIContent* aContent,
                          nsIFrame* aParent,
                          nsIFrame* aPrevInFlow)
 {
-#ifdef DEBUG
-  nsCOMPtr<nsIDOMSVGSVGElement> svgElement = do_QueryInterface(aContent);
-  NS_ASSERTION(svgElement, "Content is not an SVG 'svg' element!");
-#endif
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::svg),
+               "Content is not an SVG 'svg' element!");
 
   AddStateBits(NS_STATE_IS_OUTER_SVG |
                NS_FRAME_FONT_INFLATION_CONTAINER |
@@ -286,7 +283,7 @@ nsSVGOuterSVGFrame::GetIntrinsicRatio()
     return ratio;
   }
 
-  nsSVGViewElement* viewElement = content->GetCurrentViewElement();
+  dom::SVGViewElement* viewElement = content->GetCurrentViewElement();
   const nsSVGViewBoxRect* viewbox = nullptr;
 
   // The logic here should match HasViewBox().
diff --git a/layout/svg/nsSVGPatternFrame.cpp b/layout/svg/nsSVGPatternFrame.cpp
index 9ccdfde5fcdc..5a0a3487f97b 100644
--- a/layout/svg/nsSVGPatternFrame.cpp
+++ b/layout/svg/nsSVGPatternFrame.cpp
@@ -105,8 +105,7 @@ nsSVGPatternFrame::Init(nsIContent* aContent,
                         nsIFrame* aParent,
                         nsIFrame* aPrevInFlow)
 {
-  nsCOMPtr<nsIDOMSVGPatternElement> patternElement = do_QueryInterface(aContent);
-  NS_ASSERTION(patternElement, "Content is not an SVG pattern");
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::pattern), "Content is not an SVG pattern");
 
   return nsSVGPatternFrameBase::Init(aContent, aParent, aPrevInFlow);
 }
diff --git a/layout/svg/nsSVGStopFrame.cpp b/layout/svg/nsSVGStopFrame.cpp
index 9179c3fb258f..01f2388202c1 100644
--- a/layout/svg/nsSVGStopFrame.cpp
+++ b/layout/svg/nsSVGStopFrame.cpp
@@ -6,7 +6,6 @@
 // Keep in (case-insensitive) order:
 #include "nsFrame.h"
 #include "nsGkAtoms.h"
-#include "nsIDOMSVGStopElement.h"
 #include "nsStyleContext.h"
 #include "nsSVGEffects.h"
 
@@ -83,8 +82,8 @@ nsSVGStopFrame::Init(nsIContent* aContent,
                      nsIFrame* aParent,
                      nsIFrame* aPrevInFlow)
 {
-  nsCOMPtr<nsIDOMSVGStopElement> grad = do_QueryInterface(aContent);
-  NS_ASSERTION(grad, "Content doesn't support nsIDOMSVGStopElement");
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::stop),
+               "Content doesn't support nsIDOMSVGStopElement");
 
   return nsSVGStopFrameBase::Init(aContent, aParent, aPrevInFlow);
 }
diff --git a/layout/svg/nsSVGSwitchFrame.cpp b/layout/svg/nsSVGSwitchFrame.cpp
index 5f124ab6d08c..d354f815c11e 100644
--- a/layout/svg/nsSVGSwitchFrame.cpp
+++ b/layout/svg/nsSVGSwitchFrame.cpp
@@ -79,8 +79,8 @@ nsSVGSwitchFrame::Init(nsIContent* aContent,
                        nsIFrame* aParent,
                        nsIFrame* aPrevInFlow)
 {
-  nsCOMPtr<nsIDOMSVGSwitchElement> svgSwitch = do_QueryInterface(aContent);
-  NS_ASSERTION(svgSwitch, "Content is not an SVG switch\n");
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::svgSwitch),
+               "Content is not an SVG switch\n");
 
   return nsSVGSwitchFrameBase::Init(aContent, aParent, aPrevInFlow);
 }
diff --git a/layout/svg/nsSVGTSpanFrame.cpp b/layout/svg/nsSVGTSpanFrame.cpp
index dfefc2852c16..363e8a62f739 100644
--- a/layout/svg/nsSVGTSpanFrame.cpp
+++ b/layout/svg/nsSVGTSpanFrame.cpp
@@ -7,8 +7,6 @@
 #include "nsSVGTSpanFrame.h"
 
 // Keep others in (case-insensitive) order:
-#include "nsIDOMSVGTSpanElement.h"
-#include "nsIDOMSVGAltGlyphElement.h"
 #include "nsSVGIntegrationUtils.h"
 #include "nsSVGUtils.h"
 
@@ -60,9 +58,9 @@ nsSVGTSpanFrame::Init(nsIContent* aContent,
                  "trying to construct an SVGTSpanFrame for an invalid "
                  "container");
 
-    nsCOMPtr<nsIDOMSVGTSpanElement> tspan = do_QueryInterface(aContent);
-    nsCOMPtr<nsIDOMSVGAltGlyphElement> altGlyph = do_QueryInterface(aContent);
-    NS_ASSERTION(tspan || altGlyph, "Content is not an SVG tspan or altGlyph");
+    NS_ASSERTION(aContent->IsSVG() && (aContent->Tag() == nsGkAtoms::altGlyph ||
+                                       aContent->Tag() == nsGkAtoms::tspan),
+                 "Content is not an SVG tspan or altGlyph");
   }
 
   return nsSVGTSpanFrameBase::Init(aContent, aParent, aPrevInFlow);
diff --git a/layout/svg/nsSVGTextFrame.cpp b/layout/svg/nsSVGTextFrame.cpp
index da501afc4c9d..ab5d22e45e47 100644
--- a/layout/svg/nsSVGTextFrame.cpp
+++ b/layout/svg/nsSVGTextFrame.cpp
@@ -9,7 +9,6 @@
 // Keep others in (case-insensitive) order:
 #include "nsGkAtoms.h"
 #include "nsIDOMSVGRect.h"
-#include "nsIDOMSVGTextElement.h"
 #include "nsISVGGlyphFragmentNode.h"
 #include "nsSVGGlyphFrame.h"
 #include "nsSVGIntegrationUtils.h"
@@ -40,8 +39,8 @@ nsSVGTextFrame::Init(nsIContent* aContent,
                      nsIFrame* aParent,
                      nsIFrame* aPrevInFlow)
 {
-  nsCOMPtr<nsIDOMSVGTextElement> text = do_QueryInterface(aContent);
-  NS_ASSERTION(text, "Content is not an SVG text");
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::text),
+               "Content is not an SVG text");
 
   return nsSVGTextFrameBase::Init(aContent, aParent, aPrevInFlow);
 }
diff --git a/layout/svg/nsSVGTextPathFrame.cpp b/layout/svg/nsSVGTextPathFrame.cpp
index f5177e2459a4..a30d7a98f6f2 100644
--- a/layout/svg/nsSVGTextPathFrame.cpp
+++ b/layout/svg/nsSVGTextPathFrame.cpp
@@ -8,7 +8,6 @@
 
 // Keep others in (case-insensitive) order:
 #include "nsContentUtils.h"
-#include "nsIDOMSVGTextPathElement.h"
 #include "nsSVGEffects.h"
 #include "nsSVGLength2.h"
 #include "nsSVGPathElement.h"
@@ -43,9 +42,9 @@ nsSVGTextPathFrame::Init(nsIContent* aContent,
   NS_ASSERTION(ancestorFrame->GetType() == nsGkAtoms::svgTextFrame,
                "trying to construct an SVGTextPathFrame for an invalid "
                "container");
-  
-  nsCOMPtr<nsIDOMSVGTextPathElement> textPath = do_QueryInterface(aContent);
-  NS_ASSERTION(textPath, "Content is not an SVG textPath");
+
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::textPath),
+               "Content is not an SVG textPath");
 
   return nsSVGTextPathFrameBase::Init(aContent, aParent, aPrevInFlow);
 }
diff --git a/layout/svg/nsSVGUseFrame.cpp b/layout/svg/nsSVGUseFrame.cpp
index fb489c0377ea..be1768249a62 100644
--- a/layout/svg/nsSVGUseFrame.cpp
+++ b/layout/svg/nsSVGUseFrame.cpp
@@ -5,7 +5,6 @@
 
 // Keep in (case-insensitive) order:
 #include "nsIAnonymousContentCreator.h"
-#include "nsIDOMSVGUseElement.h"
 #include "nsSVGGFrame.h"
 #include "nsSVGUseElement.h"
 #include "nsContentList.h"
@@ -101,10 +100,8 @@ nsSVGUseFrame::Init(nsIContent* aContent,
                     nsIFrame* aParent,
                     nsIFrame* aPrevInFlow)
 {
-#ifdef DEBUG
-  nsCOMPtr<nsIDOMSVGUseElement> use = do_QueryInterface(aContent);
-  NS_ASSERTION(use, "Content is not an SVG use!");
-#endif /* DEBUG */
+  NS_ASSERTION(aContent->IsSVG(nsGkAtoms::use),
+               "Content is not an SVG use!");
 
   mHasValidDimensions =
     static_cast<nsSVGUseElement*>(aContent)->HasValidDimensions();
diff --git a/layout/tools/reftest/runreftestb2g.py b/layout/tools/reftest/runreftestb2g.py
index 1111c6310a8d..88adde9d621f 100644
--- a/layout/tools/reftest/runreftestb2g.py
+++ b/layout/tools/reftest/runreftestb2g.py
@@ -109,6 +109,10 @@ class B2GOptions(ReftestOptions):
                         type="string", dest="logcat_dir",
                         help="directory to store logcat dump files")
         defaults["logcat_dir"] = None
+        self.add_option('--busybox', action='store',
+                        type='string', dest='busybox',
+                        help="Path to busybox binary to install on device")
+        defaults['busybox'] = None
         defaults["remoteTestRoot"] = "/data/local/tests"
         defaults["logFile"] = "reftest.log"
         defaults["autorun"] = True
@@ -484,6 +488,8 @@ def main(args=sys.argv[1:]):
             kwargs['gecko_path'] = options.geckoPath
         if options.logcat_dir:
             kwargs['logcat_dir'] = options.logcat_dir
+        if options.busybox:
+            kwargs['busybox'] = options.busybox
     if options.emulator_res:
         kwargs['emulator_res'] = options.emulator_res
     if options.b2gPath:
diff --git a/media/omx-plugin/OmxPlugin.cpp b/media/omx-plugin/OmxPlugin.cpp
index 0e286ee93279..5f90863bbf31 100644
--- a/media/omx-plugin/OmxPlugin.cpp
+++ b/media/omx-plugin/OmxPlugin.cpp
@@ -84,6 +84,11 @@ ssize_t MediaStreamSource::readAt(MOZ_STAGEFRIGHT_OFF_T offset, void *data, size
     if (!mPluginHost->Read(mDecoder, ptr, offset, todo, &bytesRead)) {
       return ERROR_IO;
     }
+
+    if (bytesRead == 0) {
+      return size - todo;
+    }
+
     offset += bytesRead;
     todo -= bytesRead;
     ptr += bytesRead;
diff --git a/media/webrtc/signaling/src/sipcc/core/includes/ccapi.h b/media/webrtc/signaling/src/sipcc/core/includes/ccapi.h
index 454044baf644..2f902f2f2db6 100755
--- a/media/webrtc/signaling/src/sipcc/core/includes/ccapi.h
+++ b/media/webrtc/signaling/src/sipcc/core/includes/ccapi.h
@@ -5,7 +5,9 @@
 #ifndef _CCAPI_H_
 #define _CCAPI_H_
 
-#include "prtypes.h"
+#include "mozilla/Assertions.h"
+#include "mozilla/Util.h"
+
 #include "cpr_types.h"
 #include "cpr_memory.h"
 #include "phone_types.h"
@@ -106,7 +108,7 @@ typedef enum {
 /* please update the following cc_feature_names whenever this feature list is changed */
 
 #ifdef __CC_FEATURE_STRINGS__
-static const char *cc_feature_names[] = {
+static const char *const cc_feature_names[] = {
     "NONE",
     "HOLD",
     "RESUME",
@@ -170,7 +172,8 @@ static const char *cc_feature_names[] = {
 /* This checks at compile-time that the cc_feature_names list
  * is the same size as the cc_group_feature_t enum
  */
-PR_STATIC_ASSERT(PR_ARRAY_SIZE(cc_feature_names) == CC_FEATURE_MAX + 1);
+MOZ_STATIC_ASSERT(MOZ_ARRAY_LENGTH(cc_feature_names) == CC_FEATURE_MAX + 1,
+                  "cc_feature_names size == cc_group_feature_t size?");
 
 #endif
 
@@ -250,7 +253,7 @@ typedef enum cc_msgs_t_ {
 } cc_msgs_t;
 
 #ifdef __CC_MESSAGES_STRINGS__
-static const char *cc_msg_names[] = {
+static const char *const cc_msg_names[] = {
     "SETUP",
     "SETUP_ACK",
     "PROCEEDING",
@@ -292,7 +295,8 @@ static const char *cc_msg_names[] = {
 /* This checks at compile-time that the cc_msg_names list
  * is the same size as the cc_msgs_t enum
  */
-PR_STATIC_ASSERT(PR_ARRAY_SIZE(cc_msg_names) == CC_MSG_MAX + 1);
+MOZ_STATIC_ASSERT(MOZ_ARRAY_LENGTH(cc_msg_names) == CC_MSG_MAX + 1,
+                  "cc_msg_names size == cc_msgs_t size?");
 
 #endif //__CC_MESSAGES_STRINGS__
 
diff --git a/media/webrtc/signaling/src/sipcc/core/sipstack/sip_platform_task.c b/media/webrtc/signaling/src/sipcc/core/sipstack/sip_platform_task.c
index d639f1d8e542..0efe423fe7f8 100644
--- a/media/webrtc/signaling/src/sipcc/core/sipstack/sip_platform_task.c
+++ b/media/webrtc/signaling/src/sipcc/core/sipstack/sip_platform_task.c
@@ -153,7 +153,7 @@ sip_platform_task_init (void)
  * @return            The length of the written output not including the NULL
  *                    terminator, or -1 if an error occurs.
  */
-static PRUint32 sip_get_sock_dir_tmpl(char *out, PRUint32 outlen,
+static uint32_t sip_get_sock_dir_tmpl(char *out, uint32_t outlen,
                                       const char *suffix) {
 
     char *tmpdir;
diff --git a/media/webrtc/trunk/src/common_audio/signal_processing/signal_processing.gypi b/media/webrtc/trunk/src/common_audio/signal_processing/signal_processing.gypi
index 57310f90cffc..de50904f84a8 100644
--- a/media/webrtc/trunk/src/common_audio/signal_processing/signal_processing.gypi
+++ b/media/webrtc/trunk/src/common_audio/signal_processing/signal_processing.gypi
@@ -75,7 +75,7 @@
                 'filter_ar_fast_q12.c',
               ],
               'conditions': [
-                ['arm_neon==1', {
+                ['0==1 and arm_neon==1', {
                   'sources': [
                     'cross_correlation_neon.s',
                     'downsample_fast_neon.s',
@@ -88,6 +88,9 @@
                   ],
                 }],
               ],
+              'defines!': [
+                'WEBRTC_ARCH_ARM_NEON'
+              ],
             }],
           ],
         }],
diff --git a/memory/replace/dmd/DMD.cpp b/memory/replace/dmd/DMD.cpp
index 222761395077..035ab8fe1bef 100644
--- a/memory/replace/dmd/DMD.cpp
+++ b/memory/replace/dmd/DMD.cpp
@@ -770,6 +770,9 @@ typedef js::HashSet<StackTrace*, StackTrace, InfallibleAllocPolicy>
         StackTraceTable;
 static StackTraceTable* gStackTraceTable = nullptr;
 
+// We won't GC the stack trace table until it this many elements.
+static uint32_t gGCStackTraceTableWhenSizeExceeds = 4 * 1024;
+
 void
 StackTrace::Print(const Writer& aWriter, LocationService* aLocService) const
 {
@@ -1017,6 +1020,61 @@ public:
 typedef js::HashSet<Block, Block, InfallibleAllocPolicy> BlockTable;
 static BlockTable* gBlockTable = nullptr;
 
+typedef js::HashSet<const StackTrace*, js::DefaultHasher<const StackTrace*>,
+                    InfallibleAllocPolicy>
+        StackTraceSet;
+
+// Add a pointer to each live stack trace into the given StackTraceSet.  (A
+// stack trace is live if it's used by one of the live blocks.)
+static void
+GatherUsedStackTraces(StackTraceSet& aStackTraces)
+{
+  MOZ_ASSERT(gStateLock->IsLocked());
+  MOZ_ASSERT(Thread::Fetch()->InterceptsAreBlocked());
+
+  aStackTraces.finish();
+  aStackTraces.init(1024);
+
+  for (BlockTable::Range r = gBlockTable->all(); !r.empty(); r.popFront()) {
+    const Block& b = r.front();
+    aStackTraces.put(b.AllocStackTrace());
+    aStackTraces.put(b.ReportStackTrace1());
+    aStackTraces.put(b.ReportStackTrace2());
+  }
+
+  // Any of the stack traces added above may have been null.  For the sake of
+  // cleanliness, don't leave the null pointer in the set.
+  aStackTraces.remove(nullptr);
+}
+
+// Delete stack traces that we aren't using, and compact our hashtable.
+static void
+GCStackTraces()
+{
+  MOZ_ASSERT(gStateLock->IsLocked());
+  MOZ_ASSERT(Thread::Fetch()->InterceptsAreBlocked());
+
+  StackTraceSet usedStackTraces;
+  GatherUsedStackTraces(usedStackTraces);
+
+  // Delete all unused stack traces from gStackTraceTable.  The Enum destructor
+  // will automatically rehash and compact the table.
+  for (StackTraceTable::Enum e(*gStackTraceTable);
+       !e.empty();
+       e.popFront()) {
+    StackTrace* const& st = e.front();
+
+    if (!usedStackTraces.has(st)) {
+      e.removeFront();
+      InfallibleAllocPolicy::delete_(st);
+    }
+  }
+
+  // Schedule a GC when we have twice as many stack traces as we had right after
+  // this GC finished.
+  gGCStackTraceTableWhenSizeExceeds = 2 * gStackTraceTable->count();
+}
+
 //---------------------------------------------------------------------------
 // malloc/free callbacks
 //---------------------------------------------------------------------------
@@ -1070,6 +1128,10 @@ FreeCallback(void* aPtr, Thread* aT)
   AutoBlockIntercepts block(aT);
 
   gBlockTable->remove(aPtr);
+
+  if (gStackTraceTable->count() > gGCStackTraceTableWhenSizeExceeds) {
+    GCStackTraces();
+  }
 }
 
 //---------------------------------------------------------------------------
@@ -1886,16 +1948,8 @@ SizeOfInternal(Sizes* aSizes)
     return;
   }
 
-  js::HashSet<const StackTrace*, js::DefaultHasher<const StackTrace*>,
-              InfallibleAllocPolicy> usedStackTraces;
-  usedStackTraces.init(1024);
-
-  for(BlockTable::Range r = gBlockTable->all(); !r.empty(); r.popFront()) {
-    const Block& b = r.front();
-    usedStackTraces.put(b.AllocStackTrace());
-    usedStackTraces.put(b.ReportStackTrace1());
-    usedStackTraces.put(b.ReportStackTrace2());
-  }
+  StackTraceSet usedStackTraces;
+  GatherUsedStackTraces(usedStackTraces);
 
   for (StackTraceTable::Range r = gStackTraceTable->all();
        !r.empty();
diff --git a/mfbt/RangedPtr.h b/mfbt/RangedPtr.h
index adecf7c1a097..ecc8063410e6 100644
--- a/mfbt/RangedPtr.h
+++ b/mfbt/RangedPtr.h
@@ -60,6 +60,8 @@ class RangedPtr
 #endif
     }
 
+    uintptr_t asUintptr() const { return uintptr_t(ptr); }
+
   public:
     RangedPtr(T* p, T* start, T* end)
       : ptr(p)
@@ -128,13 +130,13 @@ class RangedPtr
 
     RangedPtr<T> operator+(size_t inc) {
       MOZ_ASSERT(inc <= size_t(-1) / sizeof(T));
-      MOZ_ASSERT(ptr + inc >= ptr);
+      MOZ_ASSERT(asUintptr() + inc * sizeof(T) >= asUintptr());
       return create(ptr + inc);
     }
 
     RangedPtr<T> operator-(size_t dec) {
       MOZ_ASSERT(dec <= size_t(-1) / sizeof(T));
-      MOZ_ASSERT(ptr - dec <= ptr);
+      MOZ_ASSERT(asUintptr() - dec * sizeof(T) <= asUintptr());
       return create(ptr - dec);
     }
 
diff --git a/mfbt/Util.h b/mfbt/Util.h
index bff7e7b17f46..dcfec6a7c7b9 100644
--- a/mfbt/Util.h
+++ b/mfbt/Util.h
@@ -269,4 +269,11 @@ ArrayEnd(T (&arr)[N])
 
 #endif /* __cplusplus */
 
+/*
+ * MOZ_ARRAY_LENGTH() is an alternative to mozilla::ArrayLength() for C files
+ * that can't use C++ template functions and for MOZ_STATIC_ASSERT() calls that
+ * can't call ArrayLength() when it is not a C++11 constexpr function.
+ */
+#define MOZ_ARRAY_LENGTH(array) (sizeof(array)/sizeof((array)[0]))
+
 #endif  /* mozilla_Util_h_ */
diff --git a/mobile/android/app/mobile.js b/mobile/android/app/mobile.js
index 65395735702b..edbeb27194c8 100644
--- a/mobile/android/app/mobile.js
+++ b/mobile/android/app/mobile.js
@@ -575,9 +575,6 @@ pref("urlclassifier.alternate_error_page", "blocked");
 // The number of random entries to send with a gethash request.
 pref("urlclassifier.gethashnoise", 4);
 
-// Randomize all UrlClassifier data with a per-client key.
-pref("urlclassifier.randomizeclient", false);
-
 // The list of tables that use the gethash request to confirm partial results.
 pref("urlclassifier.gethashtables", "goog-phish-shavar,goog-malware-shavar");
 
diff --git a/mobile/android/base/AboutHomeContent.java b/mobile/android/base/AboutHomeContent.java
index f28fb6a7dc09..1214cc6e3345 100644
--- a/mobile/android/base/AboutHomeContent.java
+++ b/mobile/android/base/AboutHomeContent.java
@@ -163,7 +163,10 @@ public class AboutHomeContent extends ScrollView
         mRemoteTabClickListener = new View.OnClickListener() {
             @Override
             public void onClick(View v) {
-                Tabs.getInstance().loadUrl((String) v.getTag(), Tabs.LOADURL_NEW_TAB);
+                int flags = Tabs.LOADURL_NEW_TAB;
+                if (Tabs.getInstance().getSelectedTab().isPrivate())
+                    flags |= Tabs.LOADURL_PRIVATE;
+                Tabs.getInstance().loadUrl((String) v.getTag(), flags);
             }
         };
 
@@ -676,7 +679,10 @@ public class AboutHomeContent extends ScrollView
 
                         container.setOnClickListener(new View.OnClickListener() {
                             public void onClick(View v) {
-                                Tabs.getInstance().loadUrlInTab(url);
+                                int flags = Tabs.LOADURL_NEW_TAB;
+                                if (Tabs.getInstance().getSelectedTab().isPrivate())
+                                    flags |= Tabs.LOADURL_PRIVATE;
+                                Tabs.getInstance().loadUrl(url, flags);
                             }
                         });
 
@@ -694,8 +700,11 @@ public class AboutHomeContent extends ScrollView
                         mLastTabs.showMoreText();
                         mLastTabs.setOnMoreTextClickListener(new View.OnClickListener() {
                             public void onClick(View v) {
+                                int flags = Tabs.LOADURL_NEW_TAB;
+                                if (Tabs.getInstance().getSelectedTab().isPrivate())
+                                    flags |= Tabs.LOADURL_PRIVATE;
                                 for (String url : lastTabUrlsList) {
-                                    Tabs.getInstance().loadUrlInTab(url);
+                                    Tabs.getInstance().loadUrl(url, flags);
                                 }
                             }
                         });
diff --git a/mobile/android/base/BrowserApp.java b/mobile/android/base/BrowserApp.java
index 6812a1b3f857..5211f8f8ea20 100644
--- a/mobile/android/base/BrowserApp.java
+++ b/mobile/android/base/BrowserApp.java
@@ -500,7 +500,7 @@ abstract public class BrowserApp extends GeckoApp
     }
 
     public void addPrivateTab() {
-        Tabs.getInstance().loadUrl("about:home", Tabs.LOADURL_NEW_TAB | Tabs.LOADURL_PRIVATE);
+        Tabs.getInstance().loadUrl("about:privatebrowsing", Tabs.LOADURL_NEW_TAB | Tabs.LOADURL_PRIVATE);
     }
 
     public void showNormalTabs() {
diff --git a/mobile/android/base/BrowserToolbar.java b/mobile/android/base/BrowserToolbar.java
index 7cfce26b7a18..0077c9b12f22 100644
--- a/mobile/android/base/BrowserToolbar.java
+++ b/mobile/android/base/BrowserToolbar.java
@@ -944,9 +944,10 @@ public class BrowserToolbar implements ViewSwitcher.ViewFactory,
         if (tab != null && tab.isEnteringReaderMode())
             return;
 
-        // Setting a null title for about:home will ensure we just see
+        // Setting a null title will ensure we just see
         // the "Enter Search or Address" placeholder text
-        if (tab != null && "about:home".equals(tab.getURL()))
+        if (tab != null && ("about:home".equals(tab.getURL()) ||
+                            "about:privatebrowsing".equals(tab.getURL())))
             title = null;
 
         mTitle.setText(title);
diff --git a/mobile/android/base/GeckoApp.java b/mobile/android/base/GeckoApp.java
index a4897eddc740..b99b62e64f7d 100644
--- a/mobile/android/base/GeckoApp.java
+++ b/mobile/android/base/GeckoApp.java
@@ -629,52 +629,8 @@ abstract public class GeckoApp
         if (ReaderModeUtils.isAboutReader(url))
             url = ReaderModeUtils.getUrlFromAboutReader(url);
 
-        if (Build.VERSION.SDK_INT >= 11) {
-            final Intent shareIntent = new Intent(Intent.ACTION_SEND);
-            shareIntent.putExtra(Intent.EXTRA_TEXT, url);
-            shareIntent.putExtra(Intent.EXTRA_SUBJECT, tab.getDisplayTitle());
-            shareIntent.setType("text/plain");
-
-            PackageManager pm = getPackageManager();
-            List<ResolveInfo> activities = pm.queryIntentActivities(shareIntent, 0);
-            Collections.sort(activities, new Comparator<ResolveInfo>() {
-                @Override
-                public int compare(ResolveInfo one, ResolveInfo two) {
-                    return one.preferredOrder - two.preferredOrder;
-                }
-
-                @Override
-                public boolean equals(Object info) {
-                    return this.equals(info);
-                }
-            });
-
-            GeckoSubMenu menu = new GeckoSubMenu(mAppContext, null);
-
-            GeckoMenu parent = (GeckoMenu) mMenu;
-            menu.setCallback(parent.getCallback());
-            menu.setMenuPresenter(parent.getMenuPresenter());
-
-            for (ResolveInfo activity : activities) {
-                 final ActivityInfo activityInfo = activity.activityInfo;
-
-                 MenuItem item = menu.add(activity.loadLabel(pm));
-                 item.setIcon(activity.loadIcon(pm));
-                 item.setOnMenuItemClickListener(new MenuItem.OnMenuItemClickListener() {
-                     @Override
-                     public boolean onMenuItemClick(MenuItem item) {
-                         shareIntent.setComponent(new ComponentName(activityInfo.packageName, activityInfo.name));
-                         startActivity(shareIntent);
-                         return true;
-                     }
-                 });
-            }
-
-            showMenu(menu);
-        } else {
-            GeckoAppShell.openUriExternal(url, "text/plain", "", "",
-                                          Intent.ACTION_SEND, tab.getDisplayTitle());
-        }
+        GeckoAppShell.openUriExternal(url, "text/plain", "", "",
+                                      Intent.ACTION_SEND, tab.getDisplayTitle());
     }
 
     protected void onSaveInstanceState(Bundle outState) {
diff --git a/mobile/android/base/awesomebar/AllPagesTab.java b/mobile/android/base/awesomebar/AllPagesTab.java
index 90044c7455ec..db33155f20bf 100644
--- a/mobile/android/base/awesomebar/AllPagesTab.java
+++ b/mobile/android/base/awesomebar/AllPagesTab.java
@@ -602,7 +602,9 @@ public class AllPagesTab extends AwesomeBarTab implements GeckoEventListener {
         mSuggestionsOptInPrompt = LayoutInflater.from(mContext).inflate(R.layout.awesomebar_suggestion_prompt, (LinearLayout)getView(), false);
         GeckoTextView promptText = (GeckoTextView) mSuggestionsOptInPrompt.findViewById(R.id.suggestions_prompt_title);
         promptText.setText(getResources().getString(R.string.suggestions_prompt, mSearchEngines.get(0).name));
-        promptText.setPrivateMode(Tabs.getInstance().getSelectedTab().isPrivate());
+        Tab tab = Tabs.getInstance().getSelectedTab();
+        if (tab != null)
+            promptText.setPrivateMode(tab.isPrivate());
 
         final View yesButton = mSuggestionsOptInPrompt.findViewById(R.id.suggestions_prompt_yes);
         final View noButton = mSuggestionsOptInPrompt.findViewById(R.id.suggestions_prompt_no);
diff --git a/mobile/android/chrome/content/aboutPrivateBrowsing.xhtml b/mobile/android/chrome/content/aboutPrivateBrowsing.xhtml
new file mode 100644
index 000000000000..770c5a953fa9
--- /dev/null
+++ b/mobile/android/chrome/content/aboutPrivateBrowsing.xhtml
@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+-->
+<!DOCTYPE html [
+  <!ENTITY % htmlDTD PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "DTD/xhtml1-strict.dtd">
+  %htmlDTD;
+  <!ENTITY % brandDTD SYSTEM "chrome://branding/locale/brand.dtd" >
+  %brandDTD;
+  <!ENTITY % globalDTD SYSTEM "chrome://global/locale/global.dtd">
+  %globalDTD;
+  <!ENTITY % privatebrowsingpageDTD SYSTEM "chrome://browser/locale/aboutPrivateBrowsing.dtd">
+  %privatebrowsingpageDTD;
+]>
+
+<html xmlns="http://www.w3.org/1999/xhtml">
+  <head>
+    <meta name="viewport" content="width=device-width, initial-scale=1; user-scalable=no"/>
+    <link rel="stylesheet" href="chrome://browser/skin/aboutPrivateBrowsing.css" type="text/css" media="all"/>
+    <link rel="icon" type="image/png" href="chrome://branding/content/favicon32.png" />
+    <script type="application/javascript;version=1.7"><![CDATA[
+      const Ci = Components.interfaces;
+      const Cu = Components.utils;
+
+      Cu.import("resource://gre/modules/PrivateBrowsingUtils.jsm");
+
+      if (!PrivateBrowsingUtils.isWindowPrivate(window)) {
+        document.addEventListener("DOMContentLoaded", function () {
+          document.body.setAttribute("class", "normal");
+        }, false);
+      }
+    ]]></script>
+  </head>
+
+  <body class="private">
+    <img class="showPrivate" src="chrome://browser/skin/images/privatebrowsing-mask.png" />
+    <h1 class="showPrivate">&privatebrowsingpage.title;</h1>
+    <h1 class="showNormal">&privatebrowsingpage.issueDesc.normal;</h1>
+
+    <div class="contentSection">
+      <p class="showPrivate">&privatebrowsingpage.description.private;</p>
+      <p class="showNormal">&privatebrowsingpage.description;</p>
+
+      <p>&privatebrowsingpage.moreInfo;</p>
+    </div>
+  </body>
+</html>
diff --git a/mobile/android/chrome/content/browser.js b/mobile/android/chrome/content/browser.js
index b7d2ae2bab65..af3094f08a96 100644
--- a/mobile/android/chrome/content/browser.js
+++ b/mobile/android/chrome/content/browser.js
@@ -1874,6 +1874,10 @@ var SelectionHandler = {
         break;
       }
       case "Tab:Selected":
+        if (this._activeType == this.TYPE_CURSOR) {
+          this.hideThumb();
+        }
+        // fall through
       case "Window:Resize": {
         if (this._activeType == this.TYPE_SELECTION) {
           // Knowing when the page is done drawing is hard, so let's just cancel
diff --git a/mobile/android/chrome/jar.mn b/mobile/android/chrome/jar.mn
index 6f0de473883d..c153f6d19a6a 100644
--- a/mobile/android/chrome/jar.mn
+++ b/mobile/android/chrome/jar.mn
@@ -15,6 +15,7 @@ chrome.jar:
   content/aboutDownloads.xhtml         (content/aboutDownloads.xhtml)
   content/aboutDownloads.js            (content/aboutDownloads.js)
   content/aboutFeedback.xhtml          (content/aboutFeedback.xhtml)
+  content/aboutPrivateBrowsing.xhtml   (content/aboutPrivateBrowsing.xhtml)
   content/aboutReader.html             (content/aboutReader.html)
   content/aboutReader.js               (content/aboutReader.js)
   content/Readability.js               (content/Readability.js)
diff --git a/mobile/android/components/AboutRedirector.js b/mobile/android/components/AboutRedirector.js
index 60172575a9ac..6819cd0a88df 100644
--- a/mobile/android/components/AboutRedirector.js
+++ b/mobile/android/components/AboutRedirector.js
@@ -67,6 +67,10 @@ let modules = {
   feedback: {
     uri: "chrome://browser/content/aboutFeedback.xhtml",
     privileged: true
+  },
+  privatebrowsing: {
+    uri: "chrome://browser/content/aboutPrivateBrowsing.xhtml",
+    privileged: true
   }
 }
 
diff --git a/mobile/android/components/MobileComponents.manifest b/mobile/android/components/MobileComponents.manifest
index fef83dca9d87..74238a0dd7c0 100644
--- a/mobile/android/components/MobileComponents.manifest
+++ b/mobile/android/components/MobileComponents.manifest
@@ -11,6 +11,7 @@ contract @mozilla.org/network/protocol/about;1?what=apps {322ba47e-7047-4f71-aeb
 contract @mozilla.org/network/protocol/about;1?what=downloads {322ba47e-7047-4f71-aebf-cb7d69325cd9}
 contract @mozilla.org/network/protocol/about;1?what=reader {322ba47e-7047-4f71-aebf-cb7d69325cd9}
 contract @mozilla.org/network/protocol/about;1?what=feedback {322ba47e-7047-4f71-aebf-cb7d69325cd9}
+contract @mozilla.org/network/protocol/about;1?what=privatebrowsing {322ba47e-7047-4f71-aebf-cb7d69325cd9}
 #ifdef MOZ_SAFE_BROWSING
 contract @mozilla.org/network/protocol/about;1?what=blocked {322ba47e-7047-4f71-aebf-cb7d69325cd9}
 #endif
diff --git a/mobile/android/config/mozconfigs/android-x86/debug b/mobile/android/config/mozconfigs/android-x86/debug
index 0e5a24cf7e6c..8c9de9588da9 100644
--- a/mobile/android/config/mozconfigs/android-x86/debug
+++ b/mobile/android/config/mozconfigs/android-x86/debug
@@ -14,9 +14,6 @@ ac_add_options --with-android-gnu-compiler-version=4.6
 ac_add_options --with-android-version=9
 ac_add_options --with-system-zlib
 
-# IonMonkey disabled in bug 789373
-ac_add_options --disable-ion
-
 export JAVA_HOME=/tools/jdk6
 export MOZILLA_OFFICIAL=1
 export MOZ_TELEMETRY_REPORTING=1
diff --git a/mobile/android/config/mozconfigs/android-x86/l10n-nightly b/mobile/android/config/mozconfigs/android-x86/l10n-nightly
index d2391b1b4436..e8c73da2a8bf 100644
--- a/mobile/android/config/mozconfigs/android-x86/l10n-nightly
+++ b/mobile/android/config/mozconfigs/android-x86/l10n-nightly
@@ -22,9 +22,6 @@ ac_add_options --with-system-zlib
 ac_add_options --enable-updater
 ac_add_options --enable-update-channel=${MOZ_UPDATE_CHANNEL}
 
-# IonMonkey disabled in bug 789373
-ac_add_options --disable-ion
-
 export JAVA_HOME=/tools/jdk6
 export MOZILLA_OFFICIAL=1
 
diff --git a/mobile/android/config/mozconfigs/android-x86/l10n-release b/mobile/android/config/mozconfigs/android-x86/l10n-release
index 1abf16d78df1..f85f7505ca02 100644
--- a/mobile/android/config/mozconfigs/android-x86/l10n-release
+++ b/mobile/android/config/mozconfigs/android-x86/l10n-release
@@ -19,9 +19,6 @@ ac_add_options --with-system-zlib
 ac_add_options --enable-updater
 ac_add_options --enable-update-channel=${MOZ_UPDATE_CHANNEL}
 
-# IonMonkey disabled in bug 789373
-ac_add_options --disable-ion
-
 export JAVA_HOME=/tools/jdk6
 export MOZILLA_OFFICIAL=1
 
diff --git a/mobile/android/config/mozconfigs/android-x86/nightly b/mobile/android/config/mozconfigs/android-x86/nightly
index 3fcc8a8c777d..c05ae70e1d38 100644
--- a/mobile/android/config/mozconfigs/android-x86/nightly
+++ b/mobile/android/config/mozconfigs/android-x86/nightly
@@ -12,9 +12,6 @@ ac_add_options --with-android-version=9
 ac_add_options --with-system-zlib
 ac_add_options --enable-update-channel=${MOZ_UPDATE_CHANNEL}
 
-# IonMonkey disabled in bug 789373
-ac_add_options --disable-ion
-
 export JAVA_HOME=/tools/jdk6
 export MOZILLA_OFFICIAL=1
 export MOZ_TELEMETRY_REPORTING=1
diff --git a/mobile/android/config/mozconfigs/android-x86/release b/mobile/android/config/mozconfigs/android-x86/release
index 304e74113dca..177db0de86d5 100644
--- a/mobile/android/config/mozconfigs/android-x86/release
+++ b/mobile/android/config/mozconfigs/android-x86/release
@@ -13,9 +13,6 @@ ac_add_options --with-system-zlib
 ac_add_options --enable-updater
 ac_add_options --enable-update-channel=${MOZ_UPDATE_CHANNEL}
 
-# IonMonkey disabled in bug 789373
-ac_add_options --disable-ion
-
 export JAVA_HOME=/tools/jdk6
 export MOZILLA_OFFICIAL=1
 export MOZ_TELEMETRY_REPORTING=1
diff --git a/mobile/android/themes/core/aboutPrivateBrowsing.css b/mobile/android/themes/core/aboutPrivateBrowsing.css
new file mode 100644
index 000000000000..e90b733a0173
--- /dev/null
+++ b/mobile/android/themes/core/aboutPrivateBrowsing.css
@@ -0,0 +1,71 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+body {
+  font-family: Roboto,"Droid Sans",helvetica,arial,clean,sans-serif;
+  font-size: 14px;
+}
+
+body.normal  .showPrivate,
+body.private .showNormal {
+  display: none;
+}
+
+div.contentSection {
+  width: 92%;
+  max-width: 400px;
+  margin: 0 auto;
+}
+
+body.private {
+  color: #9ba3ab;
+  background-image: url("chrome://browser/skin/images/privatebrowsing-bg-textured.png");
+}
+
+body.normal {
+  color: #222;
+  background-image: url("chrome://browser/skin/images/about-bg-lightblue.png");
+}
+
+h1 {
+  font-size: 24px;
+  font-weight: 100;
+  text-align: center;
+  margin: 0;
+}
+
+body.private h1 {
+  color: #d06bff;
+}
+
+img {
+  display: block;
+  width: 125px;
+  height: 125px;
+  margin: -30px auto;
+}
+
+@media all and (max-height: 399px) {
+  body {
+    margin-top: 25px;
+  }
+}
+
+@media all and (min-height: 400px) and (max-height: 599px) {
+  body {
+    margin-top: 50px;
+  }
+}
+
+@media all and (min-height: 600px) and (max-height: 799px) {
+  body {
+    margin-top: 150px;
+  }
+}
+
+@media all and (min-height: 800px) {
+  body {
+    margin-top: 250px;
+  }
+}
diff --git a/mobile/android/themes/core/images/privatebrowsing-bg-textured.png b/mobile/android/themes/core/images/privatebrowsing-bg-textured.png
new file mode 100644
index 000000000000..f9ab48016f6a
Binary files /dev/null and b/mobile/android/themes/core/images/privatebrowsing-bg-textured.png differ
diff --git a/mobile/android/themes/core/images/privatebrowsing-mask.png b/mobile/android/themes/core/images/privatebrowsing-mask.png
new file mode 100644
index 000000000000..8acc2985ad3f
Binary files /dev/null and b/mobile/android/themes/core/images/privatebrowsing-mask.png differ
diff --git a/mobile/android/themes/core/jar.mn b/mobile/android/themes/core/jar.mn
index bf0d167484bd..ed3d5e005398 100644
--- a/mobile/android/themes/core/jar.mn
+++ b/mobile/android/themes/core/jar.mn
@@ -13,6 +13,7 @@ chrome.jar:
 * skin/aboutDownloads.css                   (aboutDownloads.css)
   skin/aboutFeedback.css                    (aboutFeedback.css)
   skin/aboutMemory.css                      (aboutMemory.css)
+* skin/aboutPrivateBrowsing.css             (aboutPrivateBrowsing.css)
   skin/aboutReader.css                      (aboutReader.css)
   skin/aboutSupport.css                     (aboutSupport.css)
 * skin/browser.css                          (browser.css)
@@ -123,3 +124,5 @@ chrome.jar:
   skin/images/reader-toolbar-bg-port-xhdpi.png   (images/reader-toolbar-bg-port-xhdpi.png)
   skin/images/reader-toolbar-bg-land-xhdpi.png   (images/reader-toolbar-bg-land-xhdpi.png)
   skin/images/reader-toolbar-bg-xlarge-xhdpi.png (images/reader-toolbar-bg-xlarge-xhdpi.png)
+  skin/images/privatebrowsing-mask.png           (images/privatebrowsing-mask.png)
+  skin/images/privatebrowsing-bg-textured.png    (images/privatebrowsing-bg-textured.png)
diff --git a/modules/libpref/src/init/all.js b/modules/libpref/src/init/all.js
index cdf0654b41b0..8b188cf766e7 100644
--- a/modules/libpref/src/init/all.js
+++ b/modules/libpref/src/init/all.js
@@ -2664,12 +2664,12 @@ pref("font.name-list.monospace.x-western", "Courier,Courier New");
 pref("font.name-list.cursive.x-western", "Apple Chancery");
 pref("font.name-list.fantasy.x-western", "Papyrus");
 
-pref("font.name.serif.zh-CN", "STSong");
-pref("font.name.sans-serif.zh-CN", "STHeiti");
-pref("font.name.monospace.zh-CN", "STHeiti");
-pref("font.name-list.serif.zh-CN", "STSong,Heiti SC");
-pref("font.name-list.sans-serif.zh-CN", "STHeiti,Heiti SC");
-pref("font.name-list.monospace.zh-CN", "STHeiti,Heiti SC");
+pref("font.name.serif.zh-CN", "Times");
+pref("font.name.sans-serif.zh-CN", "Helvetica");
+pref("font.name.monospace.zh-CN", "Courier");
+pref("font.name-list.serif.zh-CN", "Times,STSong,Heiti SC");
+pref("font.name-list.sans-serif.zh-CN", "Helvetica,STHeiti,Heiti SC");
+pref("font.name-list.monospace.zh-CN", "Courier,STHeiti,Heiti SC");
 
 pref("font.name.serif.zh-TW", "Times"); 
 pref("font.name.sans-serif.zh-TW", "Helvetica");  
@@ -3915,6 +3915,18 @@ pref("dom.mozApps.dev_mode", false);
 // Lowest localId for apps.
 pref("dom.mozApps.maxLocalId", 1000);
 
+// XXX Security: You CANNOT safely add a new app store for
+// installing privileged apps just by modifying this pref and
+// adding the signing cert for that store to the cert trust
+// database. *Any* origin listed can install apps signed with
+// *any* certificate trusted; we don't try to maintain a strong
+// association between certificate with installOrign. The
+// expectation here is that in production builds the pref will
+// contain exactly one origin. However, in custom development
+// builds it may contain more than one origin so we can test
+// different stages (dev, staging, prod) of the same app store.
+pref("dom.mozApps.signed_apps_installable_from", "https://marketplace.firefox.com");
+
 // Minimum delay in milliseconds between network activity notifications (0 means
 // no notifications). The delay is the same for both download and upload, though
 // they are handled separately. This pref is only read once at startup:
diff --git a/netwerk/ipc/NeckoParent.cpp b/netwerk/ipc/NeckoParent.cpp
index aec4391f82fd..67f780698551 100644
--- a/netwerk/ipc/NeckoParent.cpp
+++ b/netwerk/ipc/NeckoParent.cpp
@@ -370,8 +370,8 @@ NeckoParent::AllocPRemoteOpenFile(const URIParams& aURI,
       if (PL_strnstr(requestedPath.BeginReading(), "/../",
                      requestedPath.Length())) {
         printf_stderr("NeckoParent::AllocPRemoteOpenFile: "
-                      "FATAL error: requested file URI contains '/../' "
-                      "KILLING CHILD PROCESS\n");
+                      "FATAL error: requested file URI '%s' contains '/../' "
+                      "KILLING CHILD PROCESS\n", requestedPath.get());
         return nullptr;
       }
     } else {
@@ -391,8 +391,10 @@ NeckoParent::AllocPRemoteOpenFile(const URIParams& aURI,
                                 NS_LossyConvertUTF16toASCII(uuid).get());
       if (!requestedPath.Equals(mustMatch)) {
         printf_stderr("NeckoParent::AllocPRemoteOpenFile: "
-                      "FATAL error: requesting file other than application.zip: "
-                      "KILLING CHILD PROCESS\n");
+                      "FATAL error: app without webapps-manage permission is "
+                      "requesting file '%s' but is only allowed to open its "
+                      "own application.zip: KILLING CHILD PROCESS\n",
+                      requestedPath.get());
         return nullptr;
       }
     }
diff --git a/netwerk/ipc/PRemoteOpenFile.ipdl b/netwerk/ipc/PRemoteOpenFile.ipdl
index 89d22079d72a..5fc5db4bb662 100644
--- a/netwerk/ipc/PRemoteOpenFile.ipdl
+++ b/netwerk/ipc/PRemoteOpenFile.ipdl
@@ -26,8 +26,10 @@ parent:
   __delete__();
 
 child:
-  // success/failure code, and if NS_SUCCEEDED(rv), an open file descriptor
-  FileOpened(FileDescriptor fd, nsresult rv);
+  // Your file handle is ready, Sir...
+  FileOpened(FileDescriptor fd);
+  // Trying to send invalid fd crashes, so we need separate method for failure
+  FileDidNotOpen();
 };
 
 
diff --git a/netwerk/ipc/RemoteOpenFileChild.cpp b/netwerk/ipc/RemoteOpenFileChild.cpp
index ecd9afc3a647..89749abdd695 100644
--- a/netwerk/ipc/RemoteOpenFileChild.cpp
+++ b/netwerk/ipc/RemoteOpenFileChild.cpp
@@ -138,26 +138,39 @@ RemoteOpenFileChild::AsyncRemoteFileOpen(int32_t aFlags,
 //-----------------------------------------------------------------------------
 
 bool
-RemoteOpenFileChild::RecvFileOpened(const FileDescriptor& aFD,
-                                    const nsresult& aRV)
+RemoteOpenFileChild::RecvFileOpened(const FileDescriptor& aFD)
 {
 #if defined(XP_WIN) || defined(MOZ_WIDGET_COCOA)
   NS_NOTREACHED("osX and Windows shouldn't be doing IPDL here");
 #else
-  if (NS_SUCCEEDED(aRV)) {
-    mNSPRFileDesc = PR_AllocFileDesc(aFD.PlatformHandle(), PR_GetFileMethods());
-  }
+  mNSPRFileDesc = PR_AllocFileDesc(aFD.PlatformHandle(), PR_GetFileMethods());
 
   MOZ_ASSERT(mListener);
-
-  mListener->OnRemoteFileOpenComplete(aRV);
-
+  mListener->OnRemoteFileOpenComplete(NS_OK);
   mListener = nullptr;     // release ref to listener
 
   // This calls NeckoChild::DeallocPRemoteOpenFile(), which deletes |this| if
   // IPDL holds the last reference.  Don't rely on |this| existing after here!
   Send__delete__(this);
+#endif
 
+  return true;
+}
+
+bool
+RemoteOpenFileChild::RecvFileDidNotOpen()
+{
+#if defined(XP_WIN) || defined(MOZ_WIDGET_COCOA)
+  NS_NOTREACHED("osX and Windows shouldn't be doing IPDL here");
+#else
+  MOZ_ASSERT(mListener);
+  printf_stderr("RemoteOpenFileChild: file was not opened!\n");
+  mListener->OnRemoteFileOpenComplete(NS_ERROR_FILE_NOT_FOUND);
+  mListener = nullptr;     // release ref to listener
+
+  // This calls NeckoChild::DeallocPRemoteOpenFile(), which deletes |this| if
+  // IPDL holds the last reference.  Don't rely on |this| existing after here!
+  Send__delete__(this);
 #endif
 
   return true;
diff --git a/netwerk/ipc/RemoteOpenFileChild.h b/netwerk/ipc/RemoteOpenFileChild.h
index 260718572d91..44877d6d14ff 100644
--- a/netwerk/ipc/RemoteOpenFileChild.h
+++ b/netwerk/ipc/RemoteOpenFileChild.h
@@ -68,7 +68,8 @@ private:
   RemoteOpenFileChild(const RemoteOpenFileChild& other);
 
 protected:
-  virtual bool RecvFileOpened(const FileDescriptor&, const nsresult&);
+  virtual bool RecvFileOpened(const FileDescriptor&);
+  virtual bool RecvFileDidNotOpen();
 
   // regular nsIFile object, that we forward most calls to.
   nsCOMPtr<nsIFile> mFile;
diff --git a/netwerk/ipc/RemoteOpenFileParent.cpp b/netwerk/ipc/RemoteOpenFileParent.cpp
index 645b69b462ce..d8492bf30942 100644
--- a/netwerk/ipc/RemoteOpenFileParent.cpp
+++ b/netwerk/ipc/RemoteOpenFileParent.cpp
@@ -50,7 +50,7 @@ RemoteOpenFileParent::RecvAsyncOpenFile()
   if (NS_SUCCEEDED(rv)) {
     int fd = open(path.get(), O_RDONLY);
     if (fd != -1) {
-      unused << SendFileOpened(FileDescriptor(fd), NS_OK);
+      unused << SendFileOpened(FileDescriptor(fd));
       // file handle needs to stay open until it's shared with child (and IPDL
       // is async, so hasn't happened yet). Close in destructor.
       mFd = fd;
@@ -60,7 +60,8 @@ RemoteOpenFileParent::RecvAsyncOpenFile()
 
   // Note: sending an invalid file descriptor currently kills the child process:
   // but that's ok for our use case (failing to open application.jar).
-  unused << SendFileOpened(FileDescriptor(mFd), NS_ERROR_NOT_AVAILABLE);
+  printf_stderr("RemoteOpenFileParent: file '%s' was not found!\n", path.get());
+  unused << SendFileDidNotOpen();
 #endif // OS_TYPE
 
   return true;
diff --git a/netwerk/mime/nsMimeTypes.h b/netwerk/mime/nsMimeTypes.h
index 3356f0694c28..c4c1b12a303a 100644
--- a/netwerk/mime/nsMimeTypes.h
+++ b/netwerk/mime/nsMimeTypes.h
@@ -16,6 +16,7 @@
    instead, to help catch typos, and make central management of them easier.
  */
 
+#define ANY_WILDCARD                        "*/*"
 #define AUDIO_WILDCARD                      "audio/*"
 #define IMAGE_WILDCARD                      "image/*"
 
@@ -81,9 +82,11 @@
 #define BINARY_OCTET_STREAM                 "binary/octet-stream"
 
 #define IMAGE_GIF                           "image/gif"
-#define IMAGE_JPG                           "image/jpeg"
-#define IMAGE_PJPG                          "image/pjpeg"
+#define IMAGE_JPEG                          "image/jpeg"
+#define IMAGE_JPG                           "image/jpg"
+#define IMAGE_PJPEG                         "image/pjpeg"
 #define IMAGE_PNG                           "image/png"
+#define IMAGE_X_PNG                         "image/x-png"
 #define IMAGE_PPM                           "image/x-portable-pixmap"
 #define IMAGE_XBM                           "image/x-xbitmap"
 #define IMAGE_XBM2                          "image/x-xbm"
@@ -91,7 +94,10 @@
 #define IMAGE_ART                           "image/x-jg"
 #define IMAGE_TIFF                          "image/tiff"
 #define IMAGE_BMP                           "image/bmp"
+#define IMAGE_BMP_MS                        "image/x-ms-bmp"
 #define IMAGE_ICO                           "image/x-icon"
+#define IMAGE_ICO_MS                        "image/vnd.microsoft.icon"
+#define IMAGE_ICON_MS                       "image/icon"
 #define IMAGE_MNG                           "video/x-mng"
 #define IMAGE_JNG                           "image/x-jng"
 #define IMAGE_SVG_XML                       "image/svg+xml"
diff --git a/netwerk/protocol/http/nsHttpHandler.cpp b/netwerk/protocol/http/nsHttpHandler.cpp
index b6328c6964f6..ea99f1466e45 100644
--- a/netwerk/protocol/http/nsHttpHandler.cpp
+++ b/netwerk/protocol/http/nsHttpHandler.cpp
@@ -632,7 +632,7 @@ nsHttpHandler::InitUserAgentComponents()
     );
 #endif
 
-#if defined(ANDROID) || defined(MOZ_PLATFORM_MAEMO)
+#if defined(ANDROID) || defined(MOZ_PLATFORM_MAEMO) || defined(MOZ_B2G)
     nsCOMPtr<nsIPropertyBag2> infoService = do_GetService("@mozilla.org/system-info;1");
     NS_ASSERTION(infoService, "Could not find a system info service");
 
diff --git a/parser/htmlparser/public/nsHTMLTagList.h b/parser/htmlparser/public/nsHTMLTagList.h
index 525023aa748a..898336f05f76 100644
--- a/parser/htmlparser/public/nsHTMLTagList.h
+++ b/parser/htmlparser/public/nsHTMLTagList.h
@@ -70,7 +70,7 @@ HTML_TAG(del, Mod)
 HTML_HTMLELEMENT_TAG(dfn)
 HTML_TAG(dir, Shared)
 HTML_TAG(div, Div)
-HTML_TAG(dl, SharedList)
+HTML_TAG(dl, DList)
 HTML_HTMLELEMENT_TAG(dt)
 HTML_HTMLELEMENT_TAG(em)
 HTML_TAG(embed, SharedObject)
@@ -120,7 +120,7 @@ HTML_HTMLELEMENT_TAG(noembed)
 HTML_HTMLELEMENT_TAG(noframes)
 HTML_HTMLELEMENT_TAG(noscript)
 HTML_TAG(object, Object)
-HTML_TAG(ol, SharedList)
+HTML_TAG(ol, OList)
 HTML_TAG(optgroup, OptGroup)
 HTML_TAG(option, Option)
 HTML_TAG(output, Output)
@@ -156,7 +156,7 @@ HTML_TAG(title, Title)
 HTML_TAG(tr, TableRow)
 HTML_HTMLELEMENT_TAG(tt)
 HTML_HTMLELEMENT_TAG(u)
-HTML_TAG(ul, SharedList)
+HTML_TAG(ul, UList)
 HTML_HTMLELEMENT_TAG(var)
 #if defined(MOZ_MEDIA)
 HTML_TAG(video, Video)
diff --git a/security/build/b2g-app-root-cert.der b/security/build/b2g-app-root-cert.der
index 490b8682b75c..9a7247c7e056 100644
Binary files a/security/build/b2g-app-root-cert.der and b/security/build/b2g-app-root-cert.der differ
diff --git a/security/build/b2g-certdata.txt b/security/build/b2g-certdata.txt
index 0e1984481432..2db616fe7a2c 100644
--- a/security/build/b2g-certdata.txt
+++ b/security/build/b2g-certdata.txt
@@ -2,13 +2,13 @@
 #
 # Certificate "b2g-app-root-cert"
 #
-# Issuer: C=US,ST=CA,L=Mountain View,O=Examplla Corporation,OU=Examplla CA,CN=Examplla Root CA 1
+# Issuer: C=US,ST=CA,L=Mountain View,O=MarketplaceTest Corporation,OU=MarketplaceTest CA,CN=MarketplaceTest Root CA 1
 # Serial Number: 1 (0x1)
-# Subject: C=US,ST=CA,L=Mountain View,O=Examplla Corporation,OU=Examplla CA,CN=Examplla Root CA 1
-# Not Valid Before: Wed Nov 21 23:00:03 2012
-# Not Valid After : Sat Nov 19 23:00:03 2022
-# Fingerprint (MD5): 05:14:37:02:CC:6B:3B:0F:EB:40:2D:FA:C7:CF:D3:B6
-# Fingerprint (SHA1): 33:F8:4F:CB:0C:1F:CE:35:32:6A:8C:A1:C3:CB:C9:BE:1F:B8:ED:9E
+# Subject: C=US,ST=CA,L=Mountain View,O=MarketplaceTest Corporation,OU=MarketplaceTest CA,CN=MarketplaceTest Root CA 1
+# Not Valid Before: Thu Dec 13 20:14:18 2012
+# Not Valid After : Sun Dec 11 20:14:18 2022
+# Fingerprint (MD5): 16:FA:62:5A:EB:A6:E0:35:72:EB:95:B0:7D:58:EE:79
+# Fingerprint (SHA1): 36:C7:33:40:5E:5C:53:8E:BD:31:B9:0F:4A:6C:30:86:64:F2:D2:E1
 CKA_CLASS CK_OBJECT_CLASS CKO_CERTIFICATE
 CKA_TOKEN CK_BBOOL CK_TRUE
 CKA_PRIVATE CK_BBOOL CK_FALSE
@@ -16,125 +16,130 @@ CKA_MODIFIABLE CK_BBOOL CK_FALSE
 CKA_LABEL UTF8 "b2g-app-root-cert"
 CKA_CERTIFICATE_TYPE CK_CERTIFICATE_TYPE CKC_X_509
 CKA_SUBJECT MULTILINE_OCTAL
-\060\201\204\061\033\060\031\006\003\125\004\003\023\022\105\170
-\141\155\160\154\154\141\040\122\157\157\164\040\103\101\040\061
-\061\024\060\022\006\003\125\004\013\023\013\105\170\141\155\160
-\154\154\141\040\103\101\061\035\060\033\006\003\125\004\012\023
-\024\105\170\141\155\160\154\154\141\040\103\157\162\160\157\162
-\141\164\151\157\156\061\026\060\024\006\003\125\004\007\023\015
-\115\157\165\156\164\141\151\156\040\126\151\145\167\061\013\060
-\011\006\003\125\004\010\023\002\103\101\061\013\060\011\006\003
-\125\004\006\023\002\125\123
+\060\201\231\061\042\060\040\006\003\125\004\003\023\031\115\141
+\162\153\145\164\160\154\141\143\145\124\145\163\164\040\122\157
+\157\164\040\103\101\040\061\061\033\060\031\006\003\125\004\013
+\023\022\115\141\162\153\145\164\160\154\141\143\145\124\145\163
+\164\040\103\101\061\044\060\042\006\003\125\004\012\023\033\115
+\141\162\153\145\164\160\154\141\143\145\124\145\163\164\040\103
+\157\162\160\157\162\141\164\151\157\156\061\026\060\024\006\003
+\125\004\007\023\015\115\157\165\156\164\141\151\156\040\126\151
+\145\167\061\013\060\011\006\003\125\004\010\023\002\103\101\061
+\013\060\011\006\003\125\004\006\023\002\125\123
 END
 CKA_ID UTF8 "0"
 CKA_ISSUER MULTILINE_OCTAL
-\060\201\204\061\033\060\031\006\003\125\004\003\023\022\105\170
-\141\155\160\154\154\141\040\122\157\157\164\040\103\101\040\061
-\061\024\060\022\006\003\125\004\013\023\013\105\170\141\155\160
-\154\154\141\040\103\101\061\035\060\033\006\003\125\004\012\023
-\024\105\170\141\155\160\154\154\141\040\103\157\162\160\157\162
-\141\164\151\157\156\061\026\060\024\006\003\125\004\007\023\015
-\115\157\165\156\164\141\151\156\040\126\151\145\167\061\013\060
-\011\006\003\125\004\010\023\002\103\101\061\013\060\011\006\003
-\125\004\006\023\002\125\123
+\060\201\231\061\042\060\040\006\003\125\004\003\023\031\115\141
+\162\153\145\164\160\154\141\143\145\124\145\163\164\040\122\157
+\157\164\040\103\101\040\061\061\033\060\031\006\003\125\004\013
+\023\022\115\141\162\153\145\164\160\154\141\143\145\124\145\163
+\164\040\103\101\061\044\060\042\006\003\125\004\012\023\033\115
+\141\162\153\145\164\160\154\141\143\145\124\145\163\164\040\103
+\157\162\160\157\162\141\164\151\157\156\061\026\060\024\006\003
+\125\004\007\023\015\115\157\165\156\164\141\151\156\040\126\151
+\145\167\061\013\060\011\006\003\125\004\010\023\002\103\101\061
+\013\060\011\006\003\125\004\006\023\002\125\123
 END
 CKA_SERIAL_NUMBER MULTILINE_OCTAL
 \002\001\001
 END
 CKA_VALUE MULTILINE_OCTAL
-\060\202\003\300\060\202\002\250\240\003\002\001\002\002\001\001
+\060\202\003\352\060\202\002\322\240\003\002\001\002\002\001\001
 \060\015\006\011\052\206\110\206\367\015\001\001\005\005\000\060
-\201\204\061\033\060\031\006\003\125\004\003\023\022\105\170\141
-\155\160\154\154\141\040\122\157\157\164\040\103\101\040\061\061
-\024\060\022\006\003\125\004\013\023\013\105\170\141\155\160\154
-\154\141\040\103\101\061\035\060\033\006\003\125\004\012\023\024
-\105\170\141\155\160\154\154\141\040\103\157\162\160\157\162\141
-\164\151\157\156\061\026\060\024\006\003\125\004\007\023\015\115
-\157\165\156\164\141\151\156\040\126\151\145\167\061\013\060\011
-\006\003\125\004\010\023\002\103\101\061\013\060\011\006\003\125
-\004\006\023\002\125\123\060\036\027\015\061\062\061\061\062\061
-\062\063\060\060\060\063\132\027\015\062\062\061\061\061\071\062
-\063\060\060\060\063\132\060\201\204\061\033\060\031\006\003\125
-\004\003\023\022\105\170\141\155\160\154\154\141\040\122\157\157
-\164\040\103\101\040\061\061\024\060\022\006\003\125\004\013\023
-\013\105\170\141\155\160\154\154\141\040\103\101\061\035\060\033
-\006\003\125\004\012\023\024\105\170\141\155\160\154\154\141\040
-\103\157\162\160\157\162\141\164\151\157\156\061\026\060\024\006
-\003\125\004\007\023\015\115\157\165\156\164\141\151\156\040\126
-\151\145\167\061\013\060\011\006\003\125\004\010\023\002\103\101
-\061\013\060\011\006\003\125\004\006\023\002\125\123\060\202\001
-\042\060\015\006\011\052\206\110\206\367\015\001\001\001\005\000
-\003\202\001\017\000\060\202\001\012\002\202\001\001\000\332\255
-\200\271\353\277\343\215\020\027\261\053\357\061\075\375\164\371
-\224\036\227\017\253\373\233\061\207\106\273\172\037\376\227\235
-\110\121\303\065\154\340\335\037\375\010\321\256\073\267\176\335
-\322\363\251\051\077\315\135\143\321\335\266\250\120\322\302\327
-\361\033\256\304\267\126\325\330\245\267\125\020\314\366\244\360
-\331\032\174\242\105\075\220\177\133\317\332\353\274\257\322\123
-\341\122\031\065\242\175\070\042\123\073\205\351\057\330\305\174
-\004\073\324\153\123\021\255\111\012\114\310\374\357\375\001\007
-\034\374\235\111\112\161\036\323\223\224\262\336\340\237\035\111
-\202\307\122\255\053\257\065\037\370\235\014\073\207\317\110\376
-\205\112\335\337\126\343\234\003\225\033\356\072\371\261\175\343
-\153\262\257\031\230\116\271\120\201\273\025\374\105\346\127\326
-\314\334\335\106\336\114\154\066\360\072\312\245\003\237\377\302
-\153\271\337\167\277\057\103\145\325\205\235\374\016\120\277\171
-\031\373\362\103\001\175\115\141\017\310\122\343\127\131\232\244
-\077\056\263\351\044\273\075\104\226\224\247\321\266\317\002\003
-\001\000\001\243\073\060\071\060\017\006\003\125\035\023\001\001
-\377\004\005\060\003\001\001\377\060\016\006\003\125\035\017\001
-\001\377\004\004\003\002\002\004\060\026\006\003\125\035\045\001
-\001\377\004\014\060\012\006\010\053\006\001\005\005\007\003\003
-\060\015\006\011\052\206\110\206\367\015\001\001\005\005\000\003
-\202\001\001\000\227\120\113\310\374\002\002\163\167\074\162\233
-\024\157\215\261\001\075\201\165\056\113\103\327\222\142\076\145
-\222\041\227\066\023\175\323\144\016\372\277\163\362\102\176\256
-\003\107\075\330\255\306\304\223\266\271\146\152\140\017\166\056
-\034\021\052\133\010\117\117\131\214\134\365\032\155\335\074\120
-\036\002\361\020\235\366\203\145\262\353\267\277\063\377\210\355
-\361\172\077\220\252\003\375\172\260\105\311\317\023\337\231\053
-\327\212\052\073\241\371\145\114\255\052\302\031\150\001\164\260
-\173\124\206\234\355\225\056\224\156\200\066\000\143\325\111\341
-\157\175\324\305\126\071\053\325\163\372\057\335\207\140\041\306
-\030\360\233\211\373\331\252\360\067\306\274\047\357\164\316\244
-\157\122\247\030\326\300\352\031\037\261\176\333\342\336\221\207
-\014\214\142\016\072\305\370\046\140\133\074\137\210\120\126\301
-\202\350\333\347\342\253\325\330\276\160\074\066\266\261\021\056
-\064\152\370\352\226\311\100\376\303\225\273\146\307\275\066\310
-\211\226\344\146\126\041\237\037\213\001\325\112\113\054\250\110
-\042\057\035\220
+\201\231\061\042\060\040\006\003\125\004\003\023\031\115\141\162
+\153\145\164\160\154\141\143\145\124\145\163\164\040\122\157\157
+\164\040\103\101\040\061\061\033\060\031\006\003\125\004\013\023
+\022\115\141\162\153\145\164\160\154\141\143\145\124\145\163\164
+\040\103\101\061\044\060\042\006\003\125\004\012\023\033\115\141
+\162\153\145\164\160\154\141\143\145\124\145\163\164\040\103\157
+\162\160\157\162\141\164\151\157\156\061\026\060\024\006\003\125
+\004\007\023\015\115\157\165\156\164\141\151\156\040\126\151\145
+\167\061\013\060\011\006\003\125\004\010\023\002\103\101\061\013
+\060\011\006\003\125\004\006\023\002\125\123\060\036\027\015\061
+\062\061\062\061\063\062\060\061\064\061\070\132\027\015\062\062
+\061\062\061\061\062\060\061\064\061\070\132\060\201\231\061\042
+\060\040\006\003\125\004\003\023\031\115\141\162\153\145\164\160
+\154\141\143\145\124\145\163\164\040\122\157\157\164\040\103\101
+\040\061\061\033\060\031\006\003\125\004\013\023\022\115\141\162
+\153\145\164\160\154\141\143\145\124\145\163\164\040\103\101\061
+\044\060\042\006\003\125\004\012\023\033\115\141\162\153\145\164
+\160\154\141\143\145\124\145\163\164\040\103\157\162\160\157\162
+\141\164\151\157\156\061\026\060\024\006\003\125\004\007\023\015
+\115\157\165\156\164\141\151\156\040\126\151\145\167\061\013\060
+\011\006\003\125\004\010\023\002\103\101\061\013\060\011\006\003
+\125\004\006\023\002\125\123\060\202\001\042\060\015\006\011\052
+\206\110\206\367\015\001\001\001\005\000\003\202\001\017\000\060
+\202\001\012\002\202\001\001\000\274\203\257\274\062\142\054\152
+\063\120\342\237\046\350\213\024\052\144\011\127\322\132\151\033
+\346\154\213\124\062\111\265\217\032\077\207\305\147\365\256\372
+\041\212\170\064\145\372\245\010\226\224\355\200\170\341\172\213
+\237\240\324\261\263\230\040\044\173\201\146\126\062\335\124\334
+\170\013\101\150\057\225\047\154\254\127\047\100\154\121\262\216
+\071\346\055\363\125\263\222\321\127\003\334\347\102\352\053\317
+\176\366\343\114\355\001\241\321\374\152\344\144\075\244\324\317
+\200\064\321\034\000\167\036\251\316\330\317\073\370\262\170\157
+\217\106\067\300\200\100\022\053\265\076\373\104\163\107\313\215
+\223\262\325\024\120\050\111\352\201\174\315\051\222\320\367\224
+\363\233\217\301\324\353\050\077\314\217\262\327\163\142\345\065
+\100\063\144\000\107\213\240\220\203\037\257\054\245\040\213\225
+\313\321\156\174\342\236\332\300\301\016\377\355\233\216\207\066
+\023\256\062\275\250\035\250\143\365\041\271\025\277\156\273\330
+\330\151\257\105\122\272\220\234\015\216\375\335\302\354\042\132
+\076\204\122\004\222\141\022\367\002\003\001\000\001\243\073\060
+\071\060\017\006\003\125\035\023\001\001\377\004\005\060\003\001
+\001\377\060\016\006\003\125\035\017\001\001\377\004\004\003\002
+\002\004\060\026\006\003\125\035\045\001\001\377\004\014\060\012
+\006\010\053\006\001\005\005\007\003\003\060\015\006\011\052\206
+\110\206\367\015\001\001\005\005\000\003\202\001\001\000\164\037
+\012\101\256\130\023\311\005\143\361\352\336\021\173\017\251\137
+\304\134\323\311\031\260\214\364\346\161\364\162\363\236\106\347
+\146\301\371\352\373\167\174\323\065\106\141\306\131\200\024\152
+\116\114\267\040\036\047\244\007\066\205\022\250\172\177\250\103
+\120\325\214\013\131\342\052\117\364\057\344\071\371\003\337\204
+\207\065\032\261\206\245\323\050\222\061\063\026\035\217\124\360
+\054\234\045\357\356\107\011\165\071\253\327\040\174\341\353\137
+\206\352\044\315\373\173\322\121\041\112\215\305\205\003\300\012
+\102\326\257\322\351\232\243\370\053\304\063\173\203\173\174\255
+\376\251\161\362\233\261\361\343\327\005\357\011\161\060\332\107
+\004\222\324\267\334\341\155\226\104\104\173\050\333\262\305\021
+\327\053\146\213\335\204\312\275\177\344\045\236\147\176\367\301
+\004\061\107\346\220\347\054\156\333\071\210\010\275\336\133\160
+\051\173\225\027\307\260\103\371\354\322\075\232\242\335\372\041
+\375\250\267\052\203\015\226\151\315\100\257\353\235\351\214\165
+\306\351\144\072\025\076\343\163\320\131\344\331\332\203
 END
 
 # Trust for "b2g-app-root-cert"
-# Issuer: C=US,ST=CA,L=Mountain View,O=Examplla Corporation,OU=Examplla CA,CN=Examplla Root CA 1
+# Issuer: C=US,ST=CA,L=Mountain View,O=MarketplaceTest Corporation,OU=MarketplaceTest CA,CN=MarketplaceTest Root CA 1
 # Serial Number: 1 (0x1)
-# Subject: C=US,ST=CA,L=Mountain View,O=Examplla Corporation,OU=Examplla CA,CN=Examplla Root CA 1
-# Not Valid Before: Wed Nov 21 23:00:03 2012
-# Not Valid After : Sat Nov 19 23:00:03 2022
-# Fingerprint (MD5): 05:14:37:02:CC:6B:3B:0F:EB:40:2D:FA:C7:CF:D3:B6
-# Fingerprint (SHA1): 33:F8:4F:CB:0C:1F:CE:35:32:6A:8C:A1:C3:CB:C9:BE:1F:B8:ED:9E
+# Subject: C=US,ST=CA,L=Mountain View,O=MarketplaceTest Corporation,OU=MarketplaceTest CA,CN=MarketplaceTest Root CA 1
+# Not Valid Before: Thu Dec 13 20:14:18 2012
+# Not Valid After : Sun Dec 11 20:14:18 2022
+# Fingerprint (MD5): 16:FA:62:5A:EB:A6:E0:35:72:EB:95:B0:7D:58:EE:79
+# Fingerprint (SHA1): 36:C7:33:40:5E:5C:53:8E:BD:31:B9:0F:4A:6C:30:86:64:F2:D2:E1
 CKA_CLASS CK_OBJECT_CLASS CKO_NSS_TRUST
 CKA_TOKEN CK_BBOOL CK_TRUE
 CKA_PRIVATE CK_BBOOL CK_FALSE
 CKA_MODIFIABLE CK_BBOOL CK_FALSE
 CKA_LABEL UTF8 "b2g-app-root-cert"
 CKA_CERT_SHA1_HASH MULTILINE_OCTAL
-\063\370\117\313\014\037\316\065\062\152\214\241\303\313\311\276
-\037\270\355\236
+\066\307\063\100\136\134\123\216\275\061\271\017\112\154\060\206
+\144\362\322\341
 END
 CKA_CERT_MD5_HASH MULTILINE_OCTAL
-\005\024\067\002\314\153\073\017\353\100\055\372\307\317\323\266
+\026\372\142\132\353\246\340\065\162\353\225\260\175\130\356\171
 END
 CKA_ISSUER MULTILINE_OCTAL
-\060\201\204\061\033\060\031\006\003\125\004\003\023\022\105\170
-\141\155\160\154\154\141\040\122\157\157\164\040\103\101\040\061
-\061\024\060\022\006\003\125\004\013\023\013\105\170\141\155\160
-\154\154\141\040\103\101\061\035\060\033\006\003\125\004\012\023
-\024\105\170\141\155\160\154\154\141\040\103\157\162\160\157\162
-\141\164\151\157\156\061\026\060\024\006\003\125\004\007\023\015
-\115\157\165\156\164\141\151\156\040\126\151\145\167\061\013\060
-\011\006\003\125\004\010\023\002\103\101\061\013\060\011\006\003
-\125\004\006\023\002\125\123
+\060\201\231\061\042\060\040\006\003\125\004\003\023\031\115\141
+\162\153\145\164\160\154\141\143\145\124\145\163\164\040\122\157
+\157\164\040\103\101\040\061\061\033\060\031\006\003\125\004\013
+\023\022\115\141\162\153\145\164\160\154\141\143\145\124\145\163
+\164\040\103\101\061\044\060\042\006\003\125\004\012\023\033\115
+\141\162\153\145\164\160\154\141\143\145\124\145\163\164\040\103
+\157\162\160\157\162\141\164\151\157\156\061\026\060\024\006\003
+\125\004\007\023\015\115\157\165\156\164\141\151\156\040\126\151
+\145\167\061\013\060\011\006\003\125\004\010\023\002\103\101\061
+\013\060\011\006\003\125\004\006\023\002\125\123
 END
 CKA_SERIAL_NUMBER MULTILINE_OCTAL
 \002\001\001
diff --git a/security/manager/boot/src/nsStrictTransportSecurityService.cpp b/security/manager/boot/src/nsStrictTransportSecurityService.cpp
index a874f79848e9..e27a2424ccf6 100644
--- a/security/manager/boot/src/nsStrictTransportSecurityService.cpp
+++ b/security/manager/boot/src/nsStrictTransportSecurityService.cpp
@@ -395,7 +395,7 @@ nsStrictTransportSecurityService::GetPreloadListEntry(const char *aHost)
   if (mUsePreloadList && currentTime < gPreloadListExpirationTime) {
     return (const nsSTSPreload *) bsearch(aHost,
                                           kSTSPreloadList,
-                                          PR_ARRAY_SIZE(kSTSPreloadList),
+                                          mozilla::ArrayLength(kSTSPreloadList),
                                           sizeof(nsSTSPreload),
                                           STSPreloadCompare);
   }
diff --git a/security/manager/ssl/src/SharedSSLState.cpp b/security/manager/ssl/src/SharedSSLState.cpp
index 3aa3d9b2ae8c..e31cf7e2a45a 100644
--- a/security/manager/ssl/src/SharedSSLState.cpp
+++ b/security/manager/ssl/src/SharedSSLState.cpp
@@ -25,8 +25,8 @@ using mozilla::unused;
 
 namespace {
 
-static PRInt32 sCertOverrideSvcExists = 0;
-static PRInt32 sCertDBExists = 0;
+static int32_t sCertOverrideSvcExists = 0;
+static int32_t sCertDBExists = 0;
 
 class MainThreadClearer : public SyncRunnableBase
 {
diff --git a/security/manager/ssl/src/nsIdentityChecking.cpp b/security/manager/ssl/src/nsIdentityChecking.cpp
index a32be397d3df..fafc127c76b9 100644
--- a/security/manager/ssl/src/nsIdentityChecking.cpp
+++ b/security/manager/ssl/src/nsIdentityChecking.cpp
@@ -1233,10 +1233,7 @@ nsNSSCertificate::hasValidEVOidTag(SECOidTag &resultOidTag, bool &validEV)
     CERT_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST
     | CERT_REV_MI_REQUIRE_SOME_FRESH_INFO_AVAILABLE;
 
-  // We need a PRUint64 here instead of a nice int64_t (until bug 634793 is
-  // fixed) to match the type used in security/nss/lib/certdb/certt.h for
-  // cert_rev_flags_per_method.
-  PRUint64 methodFlags[2];
+  uint64_t methodFlags[2];
   methodFlags[cert_revocation_method_crl] = revMethodFlags;
   methodFlags[cert_revocation_method_ocsp] = revMethodFlags;
 
diff --git a/security/manager/ssl/tests/unit/test_signed_apps/privileged-app-test-1.0.zip b/security/manager/ssl/tests/unit/test_signed_apps/privileged-app-test-1.0.zip
index 0f828fb858b3..ec137ea14ad6 100644
Binary files a/security/manager/ssl/tests/unit/test_signed_apps/privileged-app-test-1.0.zip and b/security/manager/ssl/tests/unit/test_signed_apps/privileged-app-test-1.0.zip differ
diff --git a/services/sync/tests/unit/test_history_tracker.js b/services/sync/tests/unit/test_history_tracker.js
index d6f6fc9baa1a..14c44eee0afe 100644
--- a/services/sync/tests/unit/test_history_tracker.js
+++ b/services/sync/tests/unit/test_history_tracker.js
@@ -2,6 +2,7 @@
    http://creativecommons.org/publicdomain/zero/1.0/ */
 
 Cu.import("resource://gre/modules/XPCOMUtils.jsm");
+Cu.import("resource://gre/modules/PlacesUtils.jsm");
 Cu.import("resource://services-sync/engines.js");
 Cu.import("resource://services-sync/constants.js");
 Cu.import("resource://services-sync/engines/history.js");
@@ -30,7 +31,27 @@ tracker.persistChangedIDs = false;
 let _counter = 0;
 function addVisit() {
   let uri = Utils.makeURI("http://getfirefox.com/" + _counter);
-  PlacesUtils.history.addVisit(uri, Date.now() * 1000, null, 1, false, 0);
+  let place = {
+    uri: uri,
+    visits: [ {
+      visitDate: Date.now() * 1000,
+      transitionType: PlacesUtils.history.TRANSITION_LINK
+    } ]
+  };
+  let cb = Async.makeSpinningCallback();
+  PlacesUtils.asyncHistory.updatePlaces(place, {
+    handleError: function Add_handleError() {
+      cb(new Error("Error adding history entry"));
+    },
+    handleResult: function Add_handleResult() {
+      cb();
+    },
+    handleCompletion: function Add_handleCompletion() {
+       // Nothing to do
+     }
+   });
+  // Spin the event loop to embed this async call in a sync API
+  cb.wait();
   _counter++;
   return uri;
 }
diff --git a/services/sync/tps/extensions/tps/modules/history.jsm b/services/sync/tps/extensions/tps/modules/history.jsm
index 992281da278e..f3a274cc7024 100644
--- a/services/sync/tps/extensions/tps/modules/history.jsm
+++ b/services/sync/tps/extensions/tps/modules/history.jsm
@@ -108,16 +108,33 @@ var HistoryEntry = {
       "History entry in test file must have both 'visits' " +
       "and 'uri' properties");
     let uri = Services.io.newURI(item.uri, null, null);
+    let place = {
+      uri: uri,
+      visits: []
+    };
     for each (visit in item.visits) {
-      let visitId = PlacesUtils.history.addVisit(
-                    uri,
-                    usSinceEpoch + (visit.date * 60 * 60 * 1000 * 1000),
-                    null, visit.type,
-                    visit.type == 5 || visit.type == 6, 0);
-      Logger.AssertTrue(visitId, "Error adding history entry");
-      if ("title" in item)
-        PlacesUtils.history.setPageTitle(uri, item.title);
+      place.visits.push({
+        visitDate: usSinceEpoch + (visit.date * 60 * 60 * 1000 * 1000),
+        transitionType: visit.type
+      });
     }
+    if ("title" in item) {
+      place.title = item.title;
+    }
+    let cb = Async.makeSpinningCallback();
+    PlacesUtils.asyncHistory.updatePlaces(place, {
+        handleError: function Add_handleError() {
+          cb(new Error("Error adding history entry"));
+        },
+        handleResult: function Add_handleResult() {
+          cb();
+        },
+        handleCompletion: function Add_handleCompletion() {
+          // Nothing to do
+        }
+    });
+    // Spin the event loop to embed this async call in a sync API
+    cb.wait();
   },
 
   /**
diff --git a/testing/marionette/client/marionette/emulator.py b/testing/marionette/client/marionette/emulator.py
index 811a83b55d8a..316b6dd2fd52 100644
--- a/testing/marionette/client/marionette/emulator.py
+++ b/testing/marionette/client/marionette/emulator.py
@@ -338,7 +338,10 @@ waitFor(
         # setup DNS fix for networking
         self._run_adb(['shell', 'setprop', 'net.dns1', '10.0.2.3'])
 
-    def setup(self, marionette, gecko_path=None, load_early=False):
+    def setup(self, marionette, gecko_path=None, load_early=False, busybox=None):
+        if busybox:
+            self.install_busybox(busybox)
+
         if gecko_path:
             if load_early:
                 # Inject prefs into the profile now, since we have to restart
@@ -374,8 +377,6 @@ waitFor(
         # gecko in order to avoid an adb bug in which adb will sometimes
         # hang indefinitely while copying large files to the system
         # partition.
-        push_attempts = 10
-
         print 'installing gecko binaries...'
 
         # see bug 809437 for the path that lead to this madness
@@ -384,18 +385,7 @@ waitFor(
             self._run_adb(['remount'])
             self.dm.removeDir('/data/local/b2g')
             self.dm.mkDir('/data/local/b2g')
-            for root, dirs, files in os.walk(gecko_path):
-                for filename in files:
-                    rel_path = os.path.relpath(os.path.join(root, filename), gecko_path)
-                    data_local_file = os.path.join('/data/local/b2g', rel_path)
-                    for retry in range(1, push_attempts + 1):
-                        print 'pushing', data_local_file, '(attempt %s of %s)' % (retry, push_attempts)
-                        try:
-                            self.dm.pushFile(os.path.join(root, filename), data_local_file)
-                            break
-                        except DMError:
-                            if retry == push_attempts:
-                                raise
+            self.dm.pushDir(gecko_path, '/data/local/b2g', retryLimit=10)
 
             self.dm.shellCheckOutput(['stop', 'b2g'])
 
@@ -404,15 +394,11 @@ waitFor(
                     rel_path = os.path.relpath(os.path.join(root, filename), gecko_path)
                     data_local_file = os.path.join('/data/local/b2g', rel_path)
                     system_b2g_file = os.path.join('/system/b2g', rel_path)
-                    print 'copying', data_local_file, 'to', system_b2g_file
-                    try:
-                        self.dm.shellCheckOutput(['dd',
-                                                  'if=%s' % data_local_file,
-                                                  'of=%s' % system_b2g_file])
-                    except DMError:
-                        if retry == push_attempts:
-                            raise
 
+                    print 'copying', data_local_file, 'to', system_b2g_file
+                    self.dm.shellCheckOutput(['dd',
+                                              'if=%s' % data_local_file,
+                                              'of=%s' % system_b2g_file])
             self.restart_b2g()
 
         except (DMError, MarionetteException):
diff --git a/testing/marionette/client/marionette/marionette.py b/testing/marionette/client/marionette/marionette.py
index 329ba083fb0d..f27b7365146c 100644
--- a/testing/marionette/client/marionette/marionette.py
+++ b/testing/marionette/client/marionette/marionette.py
@@ -150,9 +150,8 @@ class Marionette(object):
 
         if emulator:
             self.emulator.setup(self, gecko_path=gecko_path,
-                                load_early=load_early)
-            if busybox:
-                self.emulator.install_busybox(busybox)
+                                load_early=load_early,
+                                busybox=busybox)
 
     def __del__(self):
         if self.emulator:
diff --git a/testing/mochitest/runtestsb2g.py b/testing/mochitest/runtestsb2g.py
index 93f3ace07f16..319fd31cf6f7 100644
--- a/testing/mochitest/runtestsb2g.py
+++ b/testing/mochitest/runtestsb2g.py
@@ -102,6 +102,10 @@ class B2GOptions(MochitestOptions):
                         type="string", dest="logcat_dir",
                         help="directory to store logcat dump files")
         defaults["logcat_dir"] = None
+        self.add_option('--busybox', action='store',
+                        type='string', dest='busybox',
+                        help="Path to busybox binary to install on device")
+        defaults['busybox'] = None
 
         defaults["remoteTestRoot"] = "/data/local/tests"
         defaults["logFile"] = "mochitest.log"
@@ -482,6 +486,8 @@ def main():
             kwargs['gecko_path'] = options.geckoPath
         if options.logcat_dir:
             kwargs['logcat_dir'] = options.logcat_dir
+        if options.busybox:
+            kwargs['busybox'] = options.busybox
     # needless to say sdcard is only valid if using an emulator
     if options.sdcard:
         kwargs['sdcard'] = options.sdcard
diff --git a/testing/mozbase/mozcrash/README.md b/testing/mozbase/mozcrash/README.md
deleted file mode 100644
index ae6c8d54dec3..000000000000
--- a/testing/mozbase/mozcrash/README.md
+++ /dev/null
@@ -1,12 +0,0 @@
-# Mozcrash
-
-Package for getting a stack trace out of processes that have crashed and left behind a minidump file using the Google Breakpad library.
-
-
-## Usage example
-
-TODO
-
-    import mozcrash
-
-    #...
diff --git a/testing/mozbase/mozcrash/mozcrash/__init__.py b/testing/mozbase/mozcrash/mozcrash/__init__.py
index 35e4dce462b9..469adc431178 100644
--- a/testing/mozbase/mozcrash/mozcrash/__init__.py
+++ b/testing/mozbase/mozcrash/mozcrash/__init__.py
@@ -1,5 +1,8 @@
 # This Source Code Form is subject to the terms of the Mozilla Public
 # License, v. 2.0. If a copy of the MPL was not distributed with this file,
 # You can obtain one at http://mozilla.org/MPL/2.0/.
+"""
+mozcrash is a library for getting a stack trace out of processes that have crashed and left behind a minidump file using the Google Breakpad library.
+"""
 
 from mozcrash import *
diff --git a/testing/mozbase/mozcrash/mozcrash/mozcrash.py b/testing/mozbase/mozcrash/mozcrash/mozcrash.py
index f56d70e345f2..f22e06e85df2 100644
--- a/testing/mozbase/mozcrash/mozcrash/mozcrash.py
+++ b/testing/mozbase/mozcrash/mozcrash/mozcrash.py
@@ -2,10 +2,9 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this file,
 # You can obtain one at http://mozilla.org/MPL/2.0/.
 
-from __future__ import with_statement
 __all__ = ['check_for_crashes']
 
-import os, sys, glob, urllib2, tempfile, subprocess, shutil, urlparse, zipfile
+import os, sys, glob, urllib2, tempfile, re, subprocess, shutil, urlparse, zipfile
 import mozlog
 
 def is_url(thing):
@@ -13,7 +12,11 @@ def is_url(thing):
   Return True if thing looks like a URL.
   """
   # We want to download URLs like http://... but not Windows paths like c:\...
-  return len(urlparse.urlparse(thing).scheme) >= 2
+  parsed = urlparse.urlparse(thing)
+  if 'scheme' in parsed:
+      return len(parsed.scheme) >= 2
+  else:
+      return len(parsed[0]) >= 2
 
 def extractall(zip, path = None):
     """
@@ -33,29 +36,38 @@ def extractall(zip, path = None):
             path = os.path.split(filename)[0]
             if not os.path.isdir(path):
                 os.makedirs(path)
-        with open(filename, "wb") as dest:
-            dest.write(zip.read(name))
+
+        try:
+            f = open(filename, "wb")
+            f.write(zip.read(name))
+        finally:
+            f.close()
 
 def check_for_crashes(dump_directory, symbols_path,
                       stackwalk_binary=None,
                       dump_save_path=None,
                       test_name=None):
     """
-    Print a stack trace for minidumps left behind by a crashing program.
+    Print a stack trace for minidump files left behind by a crashing program.
 
-    Arguments:
-    dump_directory: The directory in which to look for minidumps.
-    symbols_path: The path to symbols to use for dump processing.
-                  This can either be a path to a directory
-                  containing Breakpad-format symbols, or a URL
-                  to a zip file containing a set of symbols.
-    stackwalk_binary: The path to the minidump_stackwalk binary.
-                      If not set, the environment variable
-                      MINIDUMP_STACKWALK will be checked.
-    dump_save_path: A directory in which to copy minidump files
-                    for safekeeping. If not set, the environment
-                    variable MINIDUMP_SAVE_PATH will be checked.
-    test_name: The test name to be used in log output.
+    `dump_directory` will be searched for minidump files. Any minidump files found will
+    have `stackwalk_binary` executed on them, with `symbols_path` passed as an extra
+    argument.
+
+    `stackwalk_binary` should be a path to the minidump_stackwalk binary.
+    If `stackwalk_binary` is not set, the MINIDUMP_STACKWALK environment variable
+    will be checked and its value used if it is not empty.
+
+    `symbols_path` should be a path to a directory containing symbols to use for
+    dump processing. This can either be a path to a directory containing Breakpad-format
+    symbols, or a URL to a zip file containing a set of symbols.
+                  
+    If `dump_save_path` is set, it should be a path to a directory in which to copy minidump
+    files for safekeeping after a stack trace has been printed. If not set, the environment
+    variable MINIDUMP_SAVE_PATH will be checked and its value used if it is not empty.
+                    
+    If `test_name` is set it will be used as the test name in log output. If not set the
+    filename of the calling function will be used.
 
     Returns True if any minidumps were found, False otherwise.
     """
@@ -75,10 +87,9 @@ def check_for_crashes(dump_directory, symbols_path,
     if len(dumps) == 0:
         return False
 
-    found_crash = False
     remove_symbols = False 
     # If our symbols are at a remote URL, download them now
-    if is_url(symbols_path):
+    if symbols_path and is_url(symbols_path):
         log.info("Downloading symbols from: %s", symbols_path)
         remove_symbols = True
         # Get the symbols and write them to a temporary zipfile
@@ -94,8 +105,9 @@ def check_for_crashes(dump_directory, symbols_path,
 
     try:
         for d in dumps:
-            log.info("PROCESS-CRASH | %s | application crashed (minidump found)", test_name)
-            log.info("Crash dump filename: %s", d)
+            stackwalk_output = []
+            stackwalk_output.append("Crash dump filename: " + d)
+            top_frame = None
             if symbols_path and stackwalk_binary and os.path.exists(stackwalk_binary):
                 # run minidump_stackwalk
                 p = subprocess.Popen([stackwalk_binary, d, symbols_path],
@@ -105,19 +117,36 @@ def check_for_crashes(dump_directory, symbols_path,
                 if len(out) > 3:
                     # minidump_stackwalk is chatty,
                     # so ignore stderr when it succeeds.
-                    print out
+                    stackwalk_output.append(out)
+                    # The top frame of the crash is always the line after "Thread N (crashed)"
+                    # Examples:
+                    #  0  libc.so + 0xa888
+                    #  0  libnss3.so!nssCertificate_Destroy [certificate.c : 102 + 0x0]
+                    #  0  mozjs.dll!js::GlobalObject::getDebuggers() [GlobalObject.cpp:89df18f9b6da : 580 + 0x0]
+                    #  0  libxul.so!void js::gc::MarkInternal<JSObject>(JSTracer*, JSObject**) [Marking.cpp : 92 + 0x28]
+                    lines = out.splitlines()
+                    for i, line in enumerate(lines):
+                        if "(crashed)" in line:
+                            match = re.search(r"^ 0  (?:.*!)?(?:void )?([^\[]+)", lines[i+1])
+                            if match:
+                                top_frame = "@ %s" % match.group(1).strip()
+                            break
                 else:
-                    print "stderr from minidump_stackwalk:"
-                    print err
+                    stackwalk_output.append("stderr from minidump_stackwalk:")
+                    stackwalk_output.append(err)
                 if p.returncode != 0:
-                    log.error("minidump_stackwalk exited with return code %d", p.returncode)
+                    stackwalk_output.append("minidump_stackwalk exited with return code %d" % p.returncode)
             else:
                 if not symbols_path:
-                    log.warn("No symbols path given, can't process dump.")
+                    stackwalk_output.append("No symbols path given, can't process dump.")
                 if not stackwalk_binary:
-                    log.warn("MINIDUMP_STACKWALK not set, can't process dump.")
+                    stackwalk_output.append("MINIDUMP_STACKWALK not set, can't process dump.")
                 elif stackwalk_binary and not os.path.exists(stackwalk_binary):
-                    log.warn("MINIDUMP_STACKWALK binary not found: %s", stackwalk_binary)
+                    stackwalk_output.append("MINIDUMP_STACKWALK binary not found: %s" % stackwalk_binary)
+            if not top_frame:
+                top_frame = "Unknown top frame"
+            log.error("PROCESS-CRASH | %s | application crashed [%s]", test_name, top_frame)
+            print '\n'.join(stackwalk_output)
             if dump_save_path is None:
                 dump_save_path = os.environ.get('MINIDUMP_SAVE_PATH', None)
             if dump_save_path:
@@ -129,9 +158,8 @@ def check_for_crashes(dump_directory, symbols_path,
             extra = os.path.splitext(d)[0] + ".extra"
             if os.path.exists(extra):
                 os.remove(extra)
-            found_crash = True
     finally:
         if remove_symbols:
             shutil.rmtree(symbols_path)
 
-    return found_crash
+    return True
diff --git a/testing/mozbase/mozcrash/setup.py b/testing/mozbase/mozcrash/setup.py
index 133d06bd0526..7d2be8a88823 100644
--- a/testing/mozbase/mozcrash/setup.py
+++ b/testing/mozbase/mozcrash/setup.py
@@ -2,26 +2,17 @@
 # License, v. 2.0. If a copy of the MPL was not distributed with this file,
 # You can obtain one at http://mozilla.org/MPL/2.0/.
 
-
-import os
 from setuptools import setup
 
-PACKAGE_VERSION = '0.1'
-
-# get documentation from the README
-try:
-    here = os.path.dirname(os.path.abspath(__file__))
-    description = file(os.path.join(here, 'README.md')).read()
-except (OSError, IOError):
-    description = ''
+PACKAGE_VERSION = '0.3'
 
 # dependencies
-deps = ['']
+deps = []
 
 setup(name='mozcrash',
       version=PACKAGE_VERSION,
-      description="Package for printing stack traces from minidumps left behind by crashed processes.",
-      long_description=description,
+      description="Library for printing stack traces from minidumps left behind by crashed processes",
+      long_description="see http://mozbase.readthedocs.org/",
       classifiers=[], # Get strings from http://pypi.python.org/pypi?%3Aaction=list_classifiers
       keywords='mozilla',
       author='Mozilla Automation and Tools team',
diff --git a/toolkit/components/osfile/osfile_win_front.jsm b/toolkit/components/osfile/osfile_win_front.jsm
index 5c1c75999033..4ad7da053ce2 100644
--- a/toolkit/components/osfile/osfile_win_front.jsm
+++ b/toolkit/components/osfile/osfile_win_front.jsm
@@ -314,7 +314,7 @@
      };
 
      /**
-      * Checks if a file exists
+      * Checks if a file or directory exists
       *
       * @param {string} path The path to the file.
       *
@@ -322,7 +322,7 @@
       */
      File.exists = function Win_exists(path) {
        try {
-         let file = File.open(path);
+         let file = File.open(path, FILE_STAT_MODE, FILE_STAT_OPTIONS);
          file.close();
          return true;
        } catch (x) {
diff --git a/toolkit/components/osfile/tests/mochi/worker_test_osfile_front.js b/toolkit/components/osfile/tests/mochi/worker_test_osfile_front.js
index f24498a6271b..3a7466b7cf48 100644
--- a/toolkit/components/osfile/tests/mochi/worker_test_osfile_front.js
+++ b/toolkit/components/osfile/tests/mochi/worker_test_osfile_front.js
@@ -787,5 +787,11 @@ function test_exists_file()
   info("test_exists_file: starting");
   ok(OS.File.exists(file_name), "test_exists_file: file exists (OS.File.exists)");
   ok(!OS.File.exists(file_name + ".tmp"), "test_exists_file: file does not exists (OS.File.exists)");
+
+  let dir_name = OS.Path.join("chrome", "toolkit", "components" ,"osfile",
+                               "tests", "mochi");
+  ok(OS.File.exists(dir_name), "test_exists_file: directory exists");
+  ok(!OS.File.exists(dir_name) + ".tmp", "test_exists_file: directory does not exist");
+
   info("test_exists_file: complete");
 }
diff --git a/toolkit/components/places/nsNavHistory.cpp b/toolkit/components/places/nsNavHistory.cpp
index 9df2bd042558..77604e7049ce 100644
--- a/toolkit/components/places/nsNavHistory.cpp
+++ b/toolkit/components/places/nsNavHistory.cpp
@@ -894,7 +894,6 @@ nsNavHistory::GetUpdateRequirements(const nsCOMArray<nsNavHistoryQuery>& aQuerie
 
   bool nonTimeBasedItems = false;
   bool domainBasedItems = false;
-  bool queryContainsTransitions = false;
 
   for (i = 0; i < aQueries.Count(); i ++) {
     nsNavHistoryQuery* query = aQueries[i];
@@ -905,9 +904,6 @@ nsNavHistory::GetUpdateRequirements(const nsCOMArray<nsNavHistoryQuery>& aQuerie
       return QUERYUPDATE_COMPLEX_WITH_BOOKMARKS;
     }
 
-    if (query->Transitions().Length() > 0)
-      queryContainsTransitions = true;
-
     // Note: we don't currently have any complex non-bookmarked items, but these
     // are expected to be added. Put detection of these items here.
     if (!query->SearchTerms().IsEmpty() ||
@@ -923,9 +919,6 @@ nsNavHistory::GetUpdateRequirements(const nsCOMArray<nsNavHistoryQuery>& aQuerie
       nsINavHistoryQueryOptions::RESULTS_AS_TAG_QUERY)
     return QUERYUPDATE_COMPLEX_WITH_BOOKMARKS;
 
-  if (queryContainsTransitions)
-    return QUERYUPDATE_COMPLEX;
-
   // Whenever there is a maximum number of results, 
   // and we are not a bookmark query we must requery. This
   // is because we can't generally know if any given addition/change causes
@@ -937,6 +930,7 @@ nsNavHistory::GetUpdateRequirements(const nsCOMArray<nsNavHistoryQuery>& aQuerie
     return QUERYUPDATE_HOST;
   if (aQueries.Count() == 1 && !nonTimeBasedItems)
     return QUERYUPDATE_TIME;
+
   return QUERYUPDATE_SIMPLE;
 }
 
@@ -1061,6 +1055,14 @@ nsNavHistory::EvaluateQueryForNode(const nsCOMArray<nsNavHistoryQuery>& aQueries
       }
     }
 
+    // Transitions matching.
+    const nsTArray<uint32_t>& transitions = query->Transitions();
+    if (aNode->mTransitionType > 0 &&
+        transitions.Length() &&
+        !transitions.Contains(aNode->mTransitionType)) {
+      continue; // transition doesn't match.
+    }
+
     // If we ever make it to the bottom of this loop, that means it passed all
     // tests for the given query. Since queries are ORed together, that means
     // it passed everything and we are done.
diff --git a/toolkit/components/places/nsNavHistoryResult.cpp b/toolkit/components/places/nsNavHistoryResult.cpp
index 99e061315abd..e7ee2c73b9e4 100644
--- a/toolkit/components/places/nsNavHistoryResult.cpp
+++ b/toolkit/components/places/nsNavHistoryResult.cpp
@@ -106,7 +106,8 @@ nsNavHistoryResultNode::nsNavHistoryResultNode(
   mLastModified(0),
   mIndentLevel(-1),
   mFrecency(0),
-  mHidden(false)
+  mHidden(false),
+  mTransitionType(0)
 {
   mTags.SetIsVoid(true);
 }
@@ -1952,7 +1953,8 @@ nsNavHistoryQueryResultNode::nsNavHistoryQueryResultNode(
                                   true, aOptions),
   mQueries(aQueries),
   mContentsValid(false),
-  mBatchChanges(0)
+  mBatchChanges(0),
+  mTransitions(mQueries[0]->Transitions())
 {
   NS_ASSERTION(aQueries.Count() > 0, "Must have at least one query");
 
@@ -1962,6 +1964,16 @@ nsNavHistoryQueryResultNode::nsNavHistoryQueryResultNode(
     mLiveUpdate = history->GetUpdateRequirements(mQueries, mOptions,
                                                  &mHasSearchTerms);
   }
+
+  // Collect transitions shared by all queries.
+  for (int32_t i = 1; i < mQueries.Count(); ++i) {
+    const nsTArray<uint32_t>& queryTransitions = mQueries[i]->Transitions();
+    for (uint32_t j = 0; j < mTransitions.Length() ; ++j) {
+      uint32_t transition = mTransitions.SafeElementAt(j, 0);
+      if (transition && !queryTransitions.Contains(transition))
+        mTransitions.RemoveElement(transition);
+    }
+  }
 }
 
 nsNavHistoryQueryResultNode::nsNavHistoryQueryResultNode(
@@ -1974,7 +1986,8 @@ nsNavHistoryQueryResultNode::nsNavHistoryQueryResultNode(
                                   true, aOptions),
   mQueries(aQueries),
   mContentsValid(false),
-  mBatchChanges(0)
+  mBatchChanges(0),
+  mTransitions(mQueries[0]->Transitions())
 {
   NS_ASSERTION(aQueries.Count() > 0, "Must have at least one query");
 
@@ -1984,6 +1997,16 @@ nsNavHistoryQueryResultNode::nsNavHistoryQueryResultNode(
     mLiveUpdate = history->GetUpdateRequirements(mQueries, mOptions,
                                                  &mHasSearchTerms);
   }
+
+  // Collect transitions shared by all queries.
+  for (int32_t i = 1; i < mQueries.Count(); ++i) {
+    const nsTArray<uint32_t>& queryTransitions = mQueries[i]->Transitions();
+    for (uint32_t j = 0; j < mTransitions.Length() ; ++j) {
+      uint32_t transition = mTransitions.SafeElementAt(j, 0);
+      if (transition && !queryTransitions.Contains(transition))
+        mTransitions.RemoveElement(transition);
+    }
+  }
 }
 
 nsNavHistoryQueryResultNode::~nsNavHistoryQueryResultNode() {
@@ -2603,12 +2626,19 @@ nsNavHistoryQueryResultNode::OnVisit(nsIURI* aURI, int64_t aVisitId,
       // QUERYUPDATE_SIMPLE case.
     }
     case QUERYUPDATE_SIMPLE: {
+      // If all of the queries are filtered by some transitions, skip the
+      // update if aTransitionType doesn't match any of them.
+      if (mTransitions.Length() > 0 && !mTransitions.Contains(aTransitionType))
+        return NS_OK;
+
       // The history service can tell us whether the new item should appear
       // in the result.  We first have to construct a node for it to check.
       rv = history->VisitIdToResultNode(aVisitId, mOptions,
                                         getter_AddRefs(addition));
-      if (NS_FAILED(rv) || !addition ||
-          !history->EvaluateQueryForNode(mQueries, mOptions, addition))
+      NS_ENSURE_SUCCESS(rv, rv);
+      NS_ENSURE_STATE(addition);
+      addition->mTransitionType = aTransitionType;
+      if (!history->EvaluateQueryForNode(mQueries, mOptions, addition))
         return NS_OK; // don't need to include in our query
       break;
     }
@@ -2873,7 +2903,7 @@ nsNavHistoryQueryResultNode::OnDeleteVisits(nsIURI* aURI,
     // All visits for aTransitionType have been removed, if the query is
     // filtering on such transition type, this is equivalent to an onDeleteURI
     // notification.
-    if ((mQueries[0]->Transitions()).Contains(aTransitionType)) {
+    if (mTransitions.Length() > 0 && mTransitions.Contains(aTransitionType)) {
       nsresult rv = OnDeleteURI(aURI, aGUID, aReason);
       NS_ENSURE_SUCCESS(rv, rv);
     }
diff --git a/toolkit/components/places/nsNavHistoryResult.h b/toolkit/components/places/nsNavHistoryResult.h
index 2fa1cb836d22..b2f216681c0b 100644
--- a/toolkit/components/places/nsNavHistoryResult.h
+++ b/toolkit/components/places/nsNavHistoryResult.h
@@ -382,6 +382,9 @@ public:
 
   // Hidden status of the page.  Valid only for URI nodes.
   bool mHidden;
+
+  // Transition type used when this node represents a single visit.
+  int32_t mTransitionType;
 };
 
 NS_DEFINE_STATIC_IID_ACCESSOR(nsNavHistoryResultNode, NS_NAVHISTORYRESULTNODE_IID)
@@ -749,6 +752,9 @@ public:
   nsresult NotifyIfTagsChanged(nsIURI* aURI);
 
   uint32_t mBatchChanges;
+
+  // Tracks transition type filters shared by all mQueries.
+  nsTArray<uint32_t> mTransitions;
 };
 
 
diff --git a/toolkit/components/startup/nsAppStartup.cpp b/toolkit/components/startup/nsAppStartup.cpp
index 83915b5f6f06..3a8e7495c75d 100644
--- a/toolkit/components/startup/nsAppStartup.cpp
+++ b/toolkit/components/startup/nsAppStartup.cpp
@@ -314,19 +314,23 @@ nsAppStartup::Quit(uint32_t aMode)
 
   // If we're considering quitting, we will only do so if:
   if (ferocity == eConsiderQuit) {
+#ifdef XP_MACOSX
+    nsCOMPtr<nsIAppShellService> appShell
+      (do_GetService(NS_APPSHELLSERVICE_CONTRACTID));
+    bool hasHiddenPrivateWindow = false;
+    if (appShell) {
+      appShell->GetHasHiddenPrivateWindow(&hasHiddenPrivateWindow);
+    }
+    int32_t suspiciousCount = hasHiddenPrivateWindow ? 2 : 1;
+#endif
+
     if (mConsiderQuitStopper == 0) {
       // there are no windows...
       ferocity = eAttemptQuit;
     }
 #ifdef XP_MACOSX
-#ifdef MOZ_PER_WINDOW_PRIVATE_BROWSING
-    else if (mConsiderQuitStopper == 2) {
-#else
-    else if (mConsiderQuitStopper == 1) {
-#endif
+    else if (mConsiderQuitStopper == suspiciousCount) {
       // ... or there is only a hiddenWindow left, and it's useless:
-      nsCOMPtr<nsIAppShellService> appShell
-        (do_GetService(NS_APPSHELLSERVICE_CONTRACTID));
 
       // Failure shouldn't be fatal, but will abort quit attempt:
       if (!appShell)
@@ -337,11 +341,15 @@ nsAppStartup::Quit(uint32_t aMode)
       nsCOMPtr<nsIXULWindow> hiddenWindow;
       appShell->GetHiddenWindow(getter_AddRefs(hiddenWindow));
 #ifdef MOZ_PER_WINDOW_PRIVATE_BROWSING
-      nsCOMPtr<nsIXULWindow> hiddenPrivateWindow;
-      appShell->GetHiddenPrivateWindow(getter_AddRefs(hiddenPrivateWindow));
       // If the remaining windows are useful, we won't quit:
-      if ((!hiddenWindow && !hiddenPrivateWindow) || usefulHiddenWindow)
+      nsCOMPtr<nsIXULWindow> hiddenPrivateWindow;
+      if (hasHiddenPrivateWindow) {
+        appShell->GetHiddenPrivateWindow(getter_AddRefs(hiddenPrivateWindow));
+        if ((!hiddenWindow && !hiddenPrivateWindow) || usefulHiddenWindow)
+          return NS_OK;
+      } else if (!hiddenWindow || usefulHiddenWindow) {
         return NS_OK;
+      }
 #else
       // If the one window is useful, we won't quit:
       if (!hiddenWindow || usefulHiddenWindow)
diff --git a/toolkit/components/telemetry/Makefile.in b/toolkit/components/telemetry/Makefile.in
index 5ba4732cba94..8b164c0094f3 100644
--- a/toolkit/components/telemetry/Makefile.in
+++ b/toolkit/components/telemetry/Makefile.in
@@ -50,6 +50,8 @@ CPPSRCS = \
   Telemetry.cpp \
   $(NULL)
 
+LOCAL_INCLUDES += -I$(topsrcdir)/xpcom/build
+
 EXTRA_DSO_LDOPTS += \
   $(MOZ_COMPONENT_LIBS) \
   $(MOZ_JS_LIBS) \
diff --git a/toolkit/components/telemetry/Telemetry.cpp b/toolkit/components/telemetry/Telemetry.cpp
index 32252b514e22..9a57ebcc950e 100644
--- a/toolkit/components/telemetry/Telemetry.cpp
+++ b/toolkit/components/telemetry/Telemetry.cpp
@@ -5,6 +5,12 @@
 
 #include <algorithm>
 
+#ifdef XP_MACOS
+#include <fstream>
+#endif
+
+#include <prio.h>
+
 #include "mozilla/Attributes.h"
 #include "mozilla/DebugOnly.h"
 #include "mozilla/Likely.h"
@@ -13,7 +19,9 @@
 #include "base/pickle.h"
 #include "nsIComponentManager.h"
 #include "nsIServiceManager.h"
+#include "nsCOMArray.h"
 #include "nsCOMPtr.h"
+#include "nsXPCOMPrivate.h"
 #include "mozilla/ModuleUtils.h"
 #include "nsIXPConnect.h"
 #include "mozilla/Services.h"
@@ -303,6 +311,7 @@ private:
   static bool AddonReflector(AddonEntryType *entry, JSContext *cx, JSObject *obj);
   static bool CreateHistogramForAddon(const nsACString &name,
                                       AddonHistogramInfo &info);
+  void ReadLateWritesStacks();
   AddonMapType mAddonMap;
 
   // This is used for speedy string->Telemetry::ID conversions
@@ -321,9 +330,10 @@ private:
   Mutex mHangReportsMutex;
   nsIMemoryReporter *mMemoryReporter;
 
+  CombinedStacks mLateWritesStacks; // This is collected out of the main thread.
   bool mCachedTelemetryData;
   uint32_t mLastShutdownTime;
-  std::vector<nsCOMPtr<nsIFetchTelemetryDataCallback> > mCallbacks;
+  nsCOMArray<nsIFetchTelemetryDataCallback> mCallbacks;
   friend class nsFetchTelemetryData;
 };
 
@@ -729,14 +739,15 @@ private:
 public:
   void MainThread() {
     mTelemetry->mCachedTelemetryData = true;
-    for (unsigned int i = 0, n = mTelemetry->mCallbacks.size(); i < n; ++i) {
+    for (unsigned int i = 0, n = mTelemetry->mCallbacks.Count(); i < n; ++i) {
       mTelemetry->mCallbacks[i]->Complete();
     }
-    mTelemetry->mCallbacks.clear();
+    mTelemetry->mCallbacks.Clear();
   }
 
   NS_IMETHOD Run() {
     mTelemetry->mLastShutdownTime = ReadLastShutdownDuration(mFilename);
+    mTelemetry->ReadLateWritesStacks();
     nsCOMPtr<nsIRunnable> e =
       NS_NewRunnableMethod(this, &nsFetchTelemetryData::MainThread);
     NS_ENSURE_STATE(e);
@@ -799,8 +810,8 @@ TelemetryImpl::AsyncFetchTelemetryData(nsIFetchTelemetryDataCallback *aCallback)
   }
 
   // We already have a read request running, just remember the callback.
-  if (!mCallbacks.empty()) {
-    mCallbacks.push_back(aCallback);
+  if (mCallbacks.Count() != 0) {
+    mCallbacks.AppendObject(aCallback);
     return NS_OK;
   }
 
@@ -831,7 +842,7 @@ TelemetryImpl::AsyncFetchTelemetryData(nsIFetchTelemetryDataCallback *aCallback)
     return NS_OK;
   }
 
-  mCallbacks.push_back(aCallback);
+  mCallbacks.AppendObject(aCallback);
   nsCOMPtr<nsIRunnable> event = new nsFetchTelemetryData(filename);
 
   targetThread->Dispatch(event, NS_DISPATCH_NORMAL);
@@ -1532,6 +1543,150 @@ CreateJSStackObject(JSContext *cx, const CombinedStacks &stacks) {
   return ret;
 }
 
+// Read a stack from the given file name. In case of any error, aStack is
+// unchanged.
+static void
+ReadStack(const char *aFileName, Telemetry::ProcessedStack &aStack)
+{
+#ifdef XP_MACOS
+  std::ifstream file(aFileName);
+
+  size_t numModules;
+  file >> numModules;
+  if (file.fail()) {
+    return;
+  }
+
+  char newline = file.get();
+  if (file.fail() || newline != '\n') {
+    return;
+  }
+
+  Telemetry::ProcessedStack stack;
+  for (size_t i = 0; i < numModules; ++i) {
+    std::string moduleName;
+    getline(file, moduleName);
+    if (file.fail()) {
+      return;
+    }
+
+    Telemetry::ProcessedStack::Module module = {
+      moduleName,
+      0,  // mPdbAge
+      "", // mPdbSignature
+      ""  // mPdbName
+    };
+    stack.AddModule(module);
+  }
+
+  size_t numFrames;
+  file >> numFrames;
+  if (file.fail()) {
+    return;
+  }
+
+  newline = file.get();
+  if (file.fail() || newline != '\n') {
+    return;
+  }
+
+  for (size_t i = 0; i < numFrames; ++i) {
+    uint16_t index;
+    file >> index;
+    uintptr_t offset;
+    file >> std::hex >> offset >> std::dec;
+    if (file.fail()) {
+      return;
+    }
+
+    Telemetry::ProcessedStack::Frame frame = {
+      offset,
+      index
+    };
+    stack.AddFrame(frame);
+  }
+
+  aStack = stack;
+#endif
+}
+
+void
+TelemetryImpl::ReadLateWritesStacks()
+{
+  nsCOMPtr<nsIFile> profileDir;
+  nsresult rv = NS_GetSpecialDirectory(NS_APP_USER_PROFILE_50_DIR,
+                                       getter_AddRefs(profileDir));
+  if (!profileDir || NS_FAILED(rv)) {
+    return;
+  }
+
+  nsAutoCString nativePath;
+  rv = profileDir->GetNativePath(nativePath);
+  if (NS_FAILED(rv)) {
+    return;
+  }
+
+  const char *name = nativePath.get();
+  PRDir *dir = PR_OpenDir(name);
+  if (!dir) {
+    return;
+  }
+
+  PRDirEntry *ent;
+  const char *prefix = "Telemetry.LateWriteFinal-";
+  unsigned int prefixLen = strlen(prefix);
+  while ((ent = PR_ReadDir(dir, PR_SKIP_NONE))) {
+    if (strncmp(prefix, ent->name, prefixLen) != 0) {
+      continue;
+    }
+
+    nsAutoCString stackNativePath = nativePath;
+    stackNativePath += XPCOM_FILE_PATH_SEPARATOR;
+    stackNativePath += nsDependentCString(ent->name);
+
+    Telemetry::ProcessedStack stack;
+    ReadStack(stackNativePath.get(), stack);
+    if (stack.GetStackSize() != 0) {
+      mLateWritesStacks.AddStack(stack);
+    }
+    // Delete the file so that we don't report it again on the next run.
+    PR_Delete(stackNativePath.get());
+  }
+  PR_CloseDir(dir);
+}
+
+NS_IMETHODIMP
+TelemetryImpl::GetLateWrites(JSContext *cx, jsval *ret)
+{
+  // The user must call AsyncReadTelemetryData first. We return an empty list
+  // instead of reporting a failure so that the rest of telemetry can uniformly
+  // handle the read not being available yet.
+
+  // FIXME: we allocate the js object again and again in the getter. We should
+  // figure out a way to cache it. In order to do that we have to call
+  // JS_AddNamedObjectRoot. A natural place to do so is in the TelemetryImpl
+  // constructor, but it is not clear how to get a JSContext in there.
+  // Another option would be to call it in here when we first call
+  // CreateJSStackObject, but we would still need to figure out where to call
+  // JS_RemoveObjectRoot. Would it be ok to never call JS_RemoveObjectRoot
+  // and just set the pointer to nullptr is the telemetry destructor?
+
+  JSObject *report;
+  if (!mCachedTelemetryData) {
+    CombinedStacks empty;
+    report = CreateJSStackObject(cx, empty);
+  } else {
+    report = CreateJSStackObject(cx, mLateWritesStacks);
+  }
+
+  if (report == nullptr) {
+    return NS_ERROR_FAILURE;
+  }
+
+  *ret = OBJECT_TO_JSVAL(report);
+  return NS_OK;
+}
+
 NS_IMETHODIMP
 TelemetryImpl::GetRegisteredHistograms(JSContext *cx, jsval *ret)
 {
diff --git a/toolkit/components/telemetry/TelemetryPing.js b/toolkit/components/telemetry/TelemetryPing.js
index b442af40fbda..a682ad8378b9 100644
--- a/toolkit/components/telemetry/TelemetryPing.js
+++ b/toolkit/components/telemetry/TelemetryPing.js
@@ -518,6 +518,7 @@ TelemetryPing.prototype = {
       histograms: this.getHistograms(Telemetry.histogramSnapshots),
       slowSQL: Telemetry.slowSQL,
       chromeHangs: Telemetry.chromeHangs,
+      lateWrites: Telemetry.lateWrites,
       addonHistograms: this.getAddonHistograms()
     };
 
diff --git a/toolkit/components/telemetry/nsITelemetry.idl b/toolkit/components/telemetry/nsITelemetry.idl
index 69dc669a98d0..3cefb1f04249 100644
--- a/toolkit/components/telemetry/nsITelemetry.idl
+++ b/toolkit/components/telemetry/nsITelemetry.idl
@@ -87,6 +87,18 @@ interface nsITelemetry : nsISupports
   [implicit_jscontext]
   readonly attribute jsval chromeHangs;
 
+  /*
+   * An object with two fields: memoryMap and stacks.
+   * * memoryMap is a list of loaded libraries.
+   * * stacks is a list of stacks. Each stack is a list of pairs of the form
+   *   [moduleIndex, offset]. The moduleIndex is an index into the memoryMap and
+   *   offset is an offset in the library at memoryMap[moduleIndex].
+   * This format is used to make it easier to send the stacks to the
+   * symbolication server.
+   */
+  [implicit_jscontext]
+  readonly attribute jsval lateWrites;
+
   /**
    * An object whose properties are the names of histograms defined in
    * TelemetryHistograms.h and whose corresponding values are the textual
@@ -193,8 +205,9 @@ interface nsITelemetry : nsISupports
   readonly attribute jsval addonHistogramSnapshots;
 
   /**
-   * Read data from the previous run. After the callback is called, the data is
-   * available in lastShutdownDuration.
+   * Read data from the previous run. After the callback is called, the last
+   * shutdown time is available in lastShutdownDuration and any late
+   * writes in lateWrites.
    */
   void asyncFetchTelemetryData(in nsIFetchTelemetryDataCallback aCallback);
 };
diff --git a/toolkit/components/url-classifier/Classifier.cpp b/toolkit/components/url-classifier/Classifier.cpp
index 1df8598b57e4..90619b49debc 100644
--- a/toolkit/components/url-classifier/Classifier.cpp
+++ b/toolkit/components/url-classifier/Classifier.cpp
@@ -34,7 +34,6 @@ namespace safebrowsing {
 
 Classifier::Classifier()
   : mFreshTime(45 * 60)
-  , mPerClientRandomize(true)
 {
 }
 
@@ -43,77 +42,6 @@ Classifier::~Classifier()
   Close();
 }
 
-/*
- * Generate a unique 32-bit key for this user, which we will
- * use to rehash all prefixes. This ensures that different users
- * will get hash collisions on different prefixes, which in turn
- * avoids that "unlucky" URLs get mysterious slowdowns, and that
- * the servers get spammed if any such URL should get slashdotted.
- * https://bugzilla.mozilla.org/show_bug.cgi?id=669407#c10
- */
-nsresult
-Classifier::InitKey()
-{
-  nsCOMPtr<nsIFile> storeFile;
-  nsresult rv = mStoreDirectory->Clone(getter_AddRefs(storeFile));
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  rv = storeFile->AppendNative(NS_LITERAL_CSTRING("classifier.hashkey"));
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  bool exists;
-  rv = storeFile->Exists(&exists);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  if (!exists) {
-    // generate and store key
-    nsCOMPtr<nsIRandomGenerator> rg =
-      do_GetService("@mozilla.org/security/random-generator;1");
-    NS_ENSURE_STATE(rg);
-
-    uint8_t *temp;
-    nsresult rv = rg->GenerateRandomBytes(sizeof(mHashKey), &temp);
-    NS_ENSURE_SUCCESS(rv, rv);
-    memcpy(&mHashKey, temp, sizeof(mHashKey));
-    NS_Free(temp);
-
-    nsCOMPtr<nsIOutputStream> out;
-    rv = NS_NewSafeLocalFileOutputStream(getter_AddRefs(out), storeFile,
-                                       -1, -1, 0);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    uint32_t written;
-    rv = out->Write(reinterpret_cast<char*>(&mHashKey), sizeof(uint32_t), &written);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    nsCOMPtr<nsISafeOutputStream> safeOut = do_QueryInterface(out);
-    rv = safeOut->Finish();
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    LOG(("Initialized classifier, key = %X", mHashKey));
-  } else {
-    // read key
-    nsCOMPtr<nsIInputStream> inputStream;
-    rv = NS_NewLocalFileInputStream(getter_AddRefs(inputStream), storeFile,
-                                    -1, -1, 0);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    nsCOMPtr<nsISeekableStream> seekable = do_QueryInterface(inputStream);
-    nsresult rv = seekable->Seek(nsISeekableStream::NS_SEEK_SET, 0);
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    void *buffer = &mHashKey;
-    rv = NS_ReadInputStreamToBuffer(inputStream,
-                                    &buffer,
-                                    sizeof(uint32_t));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    LOG(("Loaded classifier key = %X", mHashKey));
-  }
-
-  return NS_OK;
-}
-
 nsresult
 Classifier::SetupPathNames()
 {
@@ -198,13 +126,6 @@ Classifier::Open(nsIFile& aCacheDirectory)
   mCryptoHash = do_CreateInstance(NS_CRYPTO_HASH_CONTRACTID, &rv);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  rv = InitKey();
-  if (NS_FAILED(rv)) {
-    // Without a usable key the database is useless
-    Reset();
-    return NS_ERROR_FAILURE;
-  }
-
   mTableFreshness.Init();
 
   // Build the list of know urlclassifier lists
@@ -321,9 +242,7 @@ Classifier::Check(const nsACString& aSpec, LookupResultArray& aResults)
     for (uint32_t i = 0; i < cacheArray.Length(); i++) {
       LookupCache *cache = cacheArray[i];
       bool has, complete;
-      Prefix codedPrefix;
-      rv = cache->Has(lookupHash, hostKey, mHashKey,
-                      &has, &complete, &codedPrefix);
+      rv = cache->Has(lookupHash, &has, &complete);
       NS_ENSURE_SUCCESS(rv, rv);
       if (has) {
         LookupResult *result = aResults.AppendElement();
@@ -345,7 +264,6 @@ Classifier::Check(const nsACString& aSpec, LookupResultArray& aResults)
              age));
 
         result->hash.complete = lookupHash;
-        result->mCodedPrefix = codedPrefix;
         result->mComplete = complete;
         result->mFresh = (age < mFreshTime);
         result->mTableName.Assign(cache->TableName());
@@ -758,8 +676,7 @@ Classifier::GetLookupCache(const nsACString& aTable)
     }
   }
 
-  LookupCache *cache = new LookupCache(aTable, mStoreDirectory,
-                                       mPerClientRandomize);
+  LookupCache *cache = new LookupCache(aTable, mStoreDirectory);
   nsresult rv = cache->Init();
   if (NS_FAILED(rv)) {
     return nullptr;
diff --git a/toolkit/components/url-classifier/Classifier.h b/toolkit/components/url-classifier/Classifier.h
index 53121bf76c33..0633fab851f6 100644
--- a/toolkit/components/url-classifier/Classifier.h
+++ b/toolkit/components/url-classifier/Classifier.h
@@ -60,7 +60,6 @@ public:
   nsresult CacheCompletions(const CacheResultArray& aResults);
   uint32_t GetHashKey(void) { return mHashKey; }
   void SetFreshTime(uint32_t aTime) { mFreshTime = aTime; }
-  void SetPerClientRandomize(bool aRandomize) { mPerClientRandomize = aRandomize; }
   /*
    * Get a bunch of extra prefixes to query for completion
    * and mask the real entry being requested
@@ -84,7 +83,6 @@ private:
                              const nsACString& aTable);
 
   LookupCache *GetLookupCache(const nsACString& aTable);
-  nsresult InitKey();
 
   // Root dir of the Local profile.
   nsCOMPtr<nsIFile> mCacheDirectory;
@@ -101,7 +99,6 @@ private:
   // Stores the last time a given table was updated (seconds).
   nsDataHashtable<nsCStringHashKey, int64_t> mTableFreshness;
   uint32_t mFreshTime;
-  bool mPerClientRandomize;
 };
 
 }
diff --git a/toolkit/components/url-classifier/HashStore.cpp b/toolkit/components/url-classifier/HashStore.cpp
index 41314f93ff3a..df317b76169e 100644
--- a/toolkit/components/url-classifier/HashStore.cpp
+++ b/toolkit/components/url-classifier/HashStore.cpp
@@ -994,13 +994,6 @@ HashStore::ProcessSubs()
   RemoveMatchingPrefixes(mSubPrefixes, &mAddCompletes);
   RemoveMatchingPrefixes(mSubPrefixes, &mSubCompletes);
 
-  // Clean up temporary subs (without per-client randomization),
-  // that we temporarily stored so we could knock out completes.
-  ChunkSet dummyChunks;
-  dummyChunks.Set(0);
-  ExpireEntries(&mSubPrefixes, dummyChunks);
-  mSubChunks.Remove(dummyChunks);
-
   // Remove any remaining subbed prefixes from both addprefixes
   // and addcompletes.
   KnockoutSubs(&mSubPrefixes,  &mAddPrefixes);
diff --git a/toolkit/components/url-classifier/LookupCache.cpp b/toolkit/components/url-classifier/LookupCache.cpp
index 9ed899da9b0f..2033d4252134 100644
--- a/toolkit/components/url-classifier/LookupCache.cpp
+++ b/toolkit/components/url-classifier/LookupCache.cpp
@@ -48,10 +48,8 @@ namespace safebrowsing {
 const uint32_t LOOKUPCACHE_MAGIC = 0x1231af3e;
 const uint32_t CURRENT_VERSION = 2;
 
-LookupCache::LookupCache(const nsACString& aTableName, nsIFile* aStoreDir,
-                         bool aPerClientRandomize)
+LookupCache::LookupCache(const nsACString& aTableName, nsIFile* aStoreDir)
   : mPrimed(false)
-  , mPerClientRandomize(aPerClientRandomize)
   , mTableName(aTableName)
   , mStoreDirectory(aStoreDir)
 {
@@ -191,25 +189,14 @@ LookupCache::Dump()
 
 nsresult
 LookupCache::Has(const Completion& aCompletion,
-                 const Completion& aHostkey,
-                 const uint32_t aHashKey,
-                 bool* aHas, bool* aComplete,
-                 Prefix* aOrigPrefix)
+                 bool* aHas, bool* aComplete)
 {
   *aHas = *aComplete = false;
 
   uint32_t prefix = aCompletion.ToUint32();
-  uint32_t hostkey = aHostkey.ToUint32();
-  uint32_t codedkey;
-  nsresult rv = KeyedHash(prefix, hostkey, aHashKey, &codedkey, !mPerClientRandomize);
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  Prefix codedPrefix;
-  codedPrefix.FromUint32(codedkey);
-  *aOrigPrefix = codedPrefix;
 
   bool found;
-  rv = mPrefixSet->Contains(codedkey, &found);
+  nsresult rv = mPrefixSet->Contains(prefix, &found);
   NS_ENSURE_SUCCESS(rv, rv);
 
   LOG(("Probe in %s: %X, found %d", mTableName.get(), prefix, found));
@@ -594,63 +581,6 @@ LookupCache::GetHostKeys(const nsACString& aSpec,
   return NS_OK;
 }
 
-/* We have both a prefix and a domain. Drop the domain, but
-   hash the domain, the prefix and a random value together,
-   ensuring any collisions happens at a different points for
-   different users.
-*/
-/* static */ nsresult LookupCache::KeyedHash(uint32_t aPref, uint32_t aHostKey,
-                                             uint32_t aUserKey, uint32_t* aOut,
-                                             bool aPassthrough)
-{
-  /* Do not do any processing in passthrough mode. */
-  if (aPassthrough) {
-    *aOut = aPref;
-    return NS_OK;
-  }
-
-  /* This is a reimplementation of MurmurHash3 32-bit
-     based on the public domain C++ sources.
-     http://code.google.com/p/smhasher/source/browse/trunk/MurmurHash3.cpp
-     for nblocks = 2
-  */
-  uint32_t c1 = 0xCC9E2D51;
-  uint32_t c2 = 0x1B873593;
-  uint32_t c3 = 0xE6546B64;
-  uint32_t c4 = 0x85EBCA6B;
-  uint32_t c5 = 0xC2B2AE35;
-  uint32_t h1 = aPref; // seed
-  uint32_t k1;
-  uint32_t karr[2];
-
-  karr[0] = aHostKey;
-  karr[1] = aUserKey;
-
-  for (uint32_t i = 0; i < 2; i++) {
-    k1 = karr[i];
-    k1 *= c1;
-    k1 = (k1 << 15) | (k1 >> (32-15));
-    k1 *= c2;
-
-    h1 ^= k1;
-    h1 = (h1 << 13) | (h1 >> (32-13));
-    h1 *= 5;
-    h1 += c3;
-  }
-
-  h1 ^= 2; // len
-  // fmix
-  h1 ^= h1 >> 16;
-  h1 *= c4;
-  h1 ^= h1 >> 13;
-  h1 *= c5;
-  h1 ^= h1 >> 16;
-
-  *aOut = h1;
-
-  return NS_OK;
-}
-
 bool LookupCache::IsPrimed()
 {
   return mPrimed;
diff --git a/toolkit/components/url-classifier/LookupCache.h b/toolkit/components/url-classifier/LookupCache.h
index 6dc16893a1d9..de7546396735 100644
--- a/toolkit/components/url-classifier/LookupCache.h
+++ b/toolkit/components/url-classifier/LookupCache.h
@@ -45,9 +45,6 @@ public:
   // that is inserted to mask the true URL we are requesting
   bool mNoise;
 
-  // Value of actual key looked up in the prefixset (coded with client key)
-  Prefix mCodedPrefix;
-
   // True if we've updated this table recently-enough.
   bool mFresh;
 
@@ -89,18 +86,7 @@ public:
   static nsresult GetKey(const nsACString& aSpec, Completion* aHash,
                          nsCOMPtr<nsICryptoHash>& aCryptoHash);
 
-  /* We have both a prefix and a domain. Drop the domain, but
-     hash the domain, the prefix and a random value together,
-     ensuring any collisions happens at a different points for
-     different users. If aPassthrough is set, we ignore the
-     random value and copy prefix directly into output.
-  */
-  static nsresult KeyedHash(uint32_t aPref, uint32_t aHostKey,
-                            uint32_t aUserKey, uint32_t* aOut,
-                            bool aPassthrough);
-
-  LookupCache(const nsACString& aTableName, nsIFile* aStoreFile,
-              bool aPerClientRandomize);
+  LookupCache(const nsACString& aTableName, nsIFile* aStoreFile);
   ~LookupCache();
 
   const nsCString &TableName() const { return mTableName; }
@@ -121,10 +107,7 @@ public:
 #endif
   nsresult WriteFile();
   nsresult Has(const Completion& aCompletion,
-               const Completion& aHostkey,
-               uint32_t aHashKey,
-               bool* aHas, bool* aComplete,
-               Prefix* aOrigPrefix);
+               bool* aHas, bool* aComplete);
   bool IsPrimed();
 
 private:
@@ -147,7 +130,6 @@ private:
   Header mHeader;
 
   bool mPrimed;
-  bool mPerClientRandomize;
   nsCString mTableName;
   nsCOMPtr<nsIFile> mStoreDirectory;
   CompletionArray mCompletions;
diff --git a/toolkit/components/url-classifier/ProtocolParser.cpp b/toolkit/components/url-classifier/ProtocolParser.cpp
index 0e3117c675ed..542c302ab735 100644
--- a/toolkit/components/url-classifier/ProtocolParser.cpp
+++ b/toolkit/components/url-classifier/ProtocolParser.cpp
@@ -65,9 +65,8 @@ ParseChunkRange(nsACString::const_iterator& aBegin,
   return false;
 }
 
-ProtocolParser::ProtocolParser(uint32_t aHashKey)
+ProtocolParser::ProtocolParser()
     : mState(PROTOCOL_STATE_CONTROL)
-  , mHashKey(aHashKey)
   , mUpdateStatus(NS_OK)
   , mUpdateWait(0)
   , mResetRequested(false)
@@ -81,10 +80,9 @@ ProtocolParser::~ProtocolParser()
 }
 
 nsresult
-ProtocolParser::Init(nsICryptoHash* aHasher, bool aPerClientRandomize)
+ProtocolParser::Init(nsICryptoHash* aHasher)
 {
   mCryptoHash = aHasher;
-  mPerClientRandomize = aPerClientRandomize;
   return NS_OK;
 }
 
@@ -426,7 +424,6 @@ ProtocolParser::ProcessPlaintextChunk(const nsACString& aChunk)
     return NS_ERROR_FAILURE;
   }
 
-  nsresult rv;
   nsTArray<nsCString> lines;
   ParseString(PromiseFlatCString(aChunk), '\n', lines);
 
@@ -441,18 +438,9 @@ ProtocolParser::ProcessPlaintextChunk(const nsACString& aChunk)
         mTableUpdate->NewAddComplete(mChunkState.num, hash);
       } else {
         NS_ASSERTION(mChunkState.hashSize == 4, "Only 32- or 4-byte hashes can be used for add chunks.");
-        Completion hash;
-        Completion domHash;
-        Prefix newHash;
-        rv = LookupCache::GetKey(line, &domHash, mCryptoHash);
-        NS_ENSURE_SUCCESS(rv, rv);
+        Prefix hash;
         hash.FromPlaintext(line, mCryptoHash);
-        uint32_t codedHash;
-        rv = LookupCache::KeyedHash(hash.ToUint32(), domHash.ToUint32(), mHashKey,
-                                    &codedHash, !mPerClientRandomize);
-        NS_ENSURE_SUCCESS(rv, rv);
-        newHash.FromUint32(codedHash);
-        mTableUpdate->NewAddPrefix(mChunkState.num, newHash);
+        mTableUpdate->NewAddPrefix(mChunkState.num, hash);
       }
     } else {
       nsCString::const_iterator begin, iter, end;
@@ -474,21 +462,8 @@ ProtocolParser::ProcessPlaintextChunk(const nsACString& aChunk)
       } else {
         NS_ASSERTION(mChunkState.hashSize == 4, "Only 32- or 4-byte hashes can be used for add chunks.");
         Prefix hash;
-        Completion domHash;
-        rv = LookupCache::GetKey(Substring(iter, end), &domHash, mCryptoHash);
-        NS_ENSURE_SUCCESS(rv, rv);
         hash.FromPlaintext(Substring(iter, end), mCryptoHash);
-        uint32_t codedHash;
-        rv = LookupCache::KeyedHash(hash.ToUint32(), domHash.ToUint32(), mHashKey,
-                                    &codedHash, !mPerClientRandomize);
-        NS_ENSURE_SUCCESS(rv, rv);
-        Prefix newHash;
-        newHash.FromUint32(codedHash);
-        mTableUpdate->NewSubPrefix(addChunk, newHash, mChunkState.num);
-        // Needed to knock out completes
-        // Fake chunk nr, will cause it to be removed next update
-        mTableUpdate->NewSubPrefix(addChunk, hash, 0);
-        mTableUpdate->NewSubChunk(0);
+        mTableUpdate->NewSubPrefix(addChunk, hash, mChunkState.num);
       }
     }
   }
@@ -539,16 +514,8 @@ ProtocolParser::ProcessHostAdd(const Prefix& aDomain, uint8_t aNumEntries,
   NS_ASSERTION(mChunkState.hashSize == PREFIX_SIZE,
                "ProcessHostAdd should only be called for prefix hashes.");
 
-  uint32_t codedHash;
-  uint32_t domHash = aDomain.ToUint32();
-
   if (aNumEntries == 0) {
-    nsresult rv = LookupCache::KeyedHash(domHash, domHash, mHashKey, &codedHash,
-                                         !mPerClientRandomize);
-    NS_ENSURE_SUCCESS(rv, rv);
-    Prefix newHash;
-    newHash.FromUint32(codedHash);
-    mTableUpdate->NewAddPrefix(mChunkState.num, newHash);
+    mTableUpdate->NewAddPrefix(mChunkState.num, aDomain);
     return NS_OK;
   }
 
@@ -560,12 +527,7 @@ ProtocolParser::ProcessHostAdd(const Prefix& aDomain, uint8_t aNumEntries,
   for (uint8_t i = 0; i < aNumEntries; i++) {
     Prefix hash;
     hash.Assign(Substring(aChunk, *aStart, PREFIX_SIZE));
-    nsresult rv = LookupCache::KeyedHash(hash.ToUint32(), domHash, mHashKey, &codedHash,
-                                         !mPerClientRandomize);
-    NS_ENSURE_SUCCESS(rv, rv);
-    Prefix newHash;
-    newHash.FromUint32(codedHash);
-    mTableUpdate->NewAddPrefix(mChunkState.num, newHash);
+    mTableUpdate->NewAddPrefix(mChunkState.num, hash);
     *aStart += PREFIX_SIZE;
   }
 
@@ -579,9 +541,6 @@ ProtocolParser::ProcessHostSub(const Prefix& aDomain, uint8_t aNumEntries,
   NS_ASSERTION(mChunkState.hashSize == PREFIX_SIZE,
                "ProcessHostSub should only be called for prefix hashes.");
 
-  uint32_t codedHash;
-  uint32_t domHash = aDomain.ToUint32();
-
   if (aNumEntries == 0) {
     if ((*aStart) + 4 > aChunk.Length()) {
       NS_WARNING("Received a zero-entry sub chunk without an associated add.");
@@ -595,17 +554,7 @@ ProtocolParser::ProcessHostSub(const Prefix& aDomain, uint8_t aNumEntries,
     memcpy(&addChunk, addChunkStr.BeginReading(), 4);
     addChunk = PR_ntohl(addChunk);
 
-    nsresult rv = LookupCache::KeyedHash(domHash, domHash, mHashKey, &codedHash,
-                                         !mPerClientRandomize);
-    NS_ENSURE_SUCCESS(rv, rv);
-    Prefix newHash;
-    newHash.FromUint32(codedHash);
-
-    mTableUpdate->NewSubPrefix(addChunk, newHash, mChunkState.num);
-    // Needed to knock out completes
-    // Fake chunk nr, will cause it to be removed next update
-    mTableUpdate->NewSubPrefix(addChunk, aDomain, 0);
-    mTableUpdate->NewSubChunk(0);
+    mTableUpdate->NewSubPrefix(addChunk, aDomain, mChunkState.num);
     return NS_OK;
   }
 
@@ -626,17 +575,7 @@ ProtocolParser::ProcessHostSub(const Prefix& aDomain, uint8_t aNumEntries,
     prefix.Assign(Substring(aChunk, *aStart, PREFIX_SIZE));
     *aStart += PREFIX_SIZE;
 
-    nsresult rv = LookupCache::KeyedHash(prefix.ToUint32(), domHash, mHashKey,
-                                         &codedHash, !mPerClientRandomize);
-    NS_ENSURE_SUCCESS(rv, rv);
-    Prefix newHash;
-    newHash.FromUint32(codedHash);
-
-    mTableUpdate->NewSubPrefix(addChunk, newHash, mChunkState.num);
-    // Needed to knock out completes
-    // Fake chunk nr, will cause it to be removed next update
-    mTableUpdate->NewSubPrefix(addChunk, prefix, 0);
-    mTableUpdate->NewSubChunk(0);
+    mTableUpdate->NewSubPrefix(addChunk, prefix, mChunkState.num);
   }
 
   return NS_OK;
diff --git a/toolkit/components/url-classifier/ProtocolParser.h b/toolkit/components/url-classifier/ProtocolParser.h
index 7b5a92791f30..dd4d6f3b11e5 100644
--- a/toolkit/components/url-classifier/ProtocolParser.h
+++ b/toolkit/components/url-classifier/ProtocolParser.h
@@ -23,12 +23,12 @@ public:
     nsCString mac;
   };
 
-  ProtocolParser(uint32_t aHashKey);
+  ProtocolParser();
   ~ProtocolParser();
 
   nsresult Status() const { return mUpdateStatus; }
 
-  nsresult Init(nsICryptoHash* aHasher, bool mPerClientRandomize);
+  nsresult Init(nsICryptoHash* aHasher);
 
   nsresult InitHMAC(const nsACString& aClientKey,
                     const nsACString& aServerMAC);
@@ -93,8 +93,6 @@ private:
   };
   ChunkState mChunkState;
 
-  uint32_t mHashKey;
-  bool mPerClientRandomize;
   nsCOMPtr<nsICryptoHash> mCryptoHash;
 
   nsresult mUpdateStatus;
diff --git a/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp b/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
index 66422a450ffd..cbcda737d604 100644
--- a/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
+++ b/toolkit/components/url-classifier/nsUrlClassifierDBService.cpp
@@ -63,9 +63,6 @@ PRLogModuleInfo *gUrlClassifierDbServiceLog = nullptr;
 #define CHECK_PHISHING_PREF     "browser.safebrowsing.enabled"
 #define CHECK_PHISHING_DEFAULT  false
 
-#define RANDOMIZE_CLIENT_PREF      "urlclassifier.randomizeclient"
-#define RANDOMIZE_CLIENT_DEFAULT   false
-
 #define GETHASH_NOISE_PREF      "urlclassifier.gethashnoise"
 #define GETHASH_NOISE_DEFAULT   4
 
@@ -117,8 +114,7 @@ public:
   NS_DECL_NSIURLCLASSIFIERDBSERVICE
   NS_DECL_NSIURLCLASSIFIERDBSERVICEWORKER
 
-  nsresult Init(uint32_t aGethashNoise, nsCOMPtr<nsIFile> aCacheDir,
-                bool aPerClientRandomize);
+  nsresult Init(uint32_t aGethashNoise, nsCOMPtr<nsIFile> aCacheDir);
 
   // Queue a lookup for the worker to perform, called in the main thread.
   nsresult QueueLookup(const nsACString& lookupKey,
@@ -181,15 +177,9 @@ private:
   // The client key with which the data from the server will be MAC'ed.
   nsCString mUpdateClientKey;
 
-  // The client-specific hash key to rehash
-  uint32_t mHashKey;
-
   // The number of noise entries to add to the set of lookup results.
   uint32_t mGethashNoise;
 
-  // Randomize clients with a key or not.
-  bool mPerClientRandomize;
-
   // Pending lookups are stored in a queue for processing.  The queue
   // is protected by mPendingLookupLock.
   Mutex mPendingLookupLock;
@@ -212,7 +202,6 @@ NS_IMPL_THREADSAFE_ISUPPORTS2(nsUrlClassifierDBServiceWorker,
 nsUrlClassifierDBServiceWorker::nsUrlClassifierDBServiceWorker()
   : mInStream(false)
   , mGethashNoise(0)
-  , mPerClientRandomize(true)
   , mPendingLookupLock("nsUrlClassifierDBServerWorker.mPendingLookupLock")
 {
 }
@@ -226,12 +215,10 @@ nsUrlClassifierDBServiceWorker::~nsUrlClassifierDBServiceWorker()
 
 nsresult
 nsUrlClassifierDBServiceWorker::Init(uint32_t aGethashNoise,
-                                     nsCOMPtr<nsIFile> aCacheDir,
-                                     bool aPerClientRandomize)
+                                     nsCOMPtr<nsIFile> aCacheDir)
 {
   mGethashNoise = aGethashNoise;
   mCacheDir = aCacheDir;
-  mPerClientRandomize = aPerClientRandomize;
 
   ResetUpdate();
 
@@ -323,7 +310,7 @@ nsUrlClassifierDBServiceWorker::DoLookup(const nsACString& spec,
       // We're going to be doing a gethash request, add some extra entries.
       // Note that we cannot pass the first two by reference, because we
       // add to completes, whicah can cause completes to reallocate and move.
-      AddNoise(completes->ElementAt(i).mCodedPrefix,
+      AddNoise(completes->ElementAt(i).hash.prefix,
                completes->ElementAt(i).mTableName,
                mGethashNoise, *completes);
       break;
@@ -485,11 +472,11 @@ nsUrlClassifierDBServiceWorker::BeginStream(const nsACString &table,
 
   NS_ASSERTION(!mProtocolParser, "Should not have a protocol parser.");
 
-  mProtocolParser = new ProtocolParser(mHashKey);
+  mProtocolParser = new ProtocolParser();
   if (!mProtocolParser)
     return NS_ERROR_OUT_OF_MEMORY;
 
-  mProtocolParser->Init(mCryptoHash, mPerClientRandomize);
+  mProtocolParser->Init(mCryptoHash);
 
   nsresult rv;
 
@@ -709,7 +696,7 @@ nsUrlClassifierDBServiceWorker::CacheCompletions(CacheResultArray *results)
   // Ownership is transferred in to us
   nsAutoPtr<CacheResultArray> resultsPtr(results);
 
-  nsAutoPtr<ProtocolParser> pParse(new ProtocolParser(mHashKey));
+  nsAutoPtr<ProtocolParser> pParse(new ProtocolParser());
   nsTArray<TableUpdate*> updates;
 
   // Only cache results for tables that we have, don't take
@@ -780,12 +767,10 @@ nsUrlClassifierDBServiceWorker::OpenDb()
   }
 
   classifier->SetFreshTime(gFreshnessGuarantee);
-  classifier->SetPerClientRandomize(mPerClientRandomize);
 
   rv = classifier->Open(*mCacheDir);
   NS_ENSURE_SUCCESS(rv, rv);
 
-  mHashKey = classifier->GetHashKey();
   mClassifier = classifier;
 
   return NS_OK;
@@ -1107,7 +1092,6 @@ nsUrlClassifierDBService::GetInstance(nsresult *result)
 nsUrlClassifierDBService::nsUrlClassifierDBService()
  : mCheckMalware(CHECK_MALWARE_DEFAULT)
  , mCheckPhishing(CHECK_PHISHING_DEFAULT)
- , mPerClientRandomize(true)
  , mInUpdate(false)
 {
 }
@@ -1159,15 +1143,6 @@ nsUrlClassifierDBService::Init()
     PR_ATOMIC_SET(&gFreshnessGuarantee, NS_SUCCEEDED(rv) ? tmpint : CONFIRM_AGE_DEFAULT_SEC);
 
     prefs->AddObserver(CONFIRM_AGE_PREF, this, false);
-
-    rv = prefs->GetBoolPref(RANDOMIZE_CLIENT_PREF, &tmpbool);
-    mPerClientRandomize = NS_SUCCEEDED(rv) ? tmpbool : RANDOMIZE_CLIENT_DEFAULT;
-
-    LOG(("Per client randomization is %s",
-         mPerClientRandomize ? "enabled" : "DISABLED"));
-
-    /* We do not observe for runtime changes as changing this preference
-       in flight kills the database, so it's not really supported. */
   }
 
   // Force PSM loading on main thread
@@ -1192,7 +1167,7 @@ nsUrlClassifierDBService::Init()
   if (!mWorker)
     return NS_ERROR_OUT_OF_MEMORY;
 
-  rv = mWorker->Init(gethashNoise, cacheDir, mPerClientRandomize);
+  rv = mWorker->Init(gethashNoise, cacheDir);
   if (NS_FAILED(rv)) {
     mWorker = nullptr;
     return rv;
diff --git a/toolkit/content/LightweightThemeConsumer.jsm b/toolkit/content/LightweightThemeConsumer.jsm
index 91b5d87e65a8..4f22f9a89174 100644
--- a/toolkit/content/LightweightThemeConsumer.jsm
+++ b/toolkit/content/LightweightThemeConsumer.jsm
@@ -9,12 +9,19 @@ Components.utils.import("resource://gre/modules/XPCOMUtils.jsm");
 XPCOMUtils.defineLazyModuleGetter(this, "LightweightThemeImageOptimizer",
   "resource://gre/modules/LightweightThemeImageOptimizer.jsm");
 
+XPCOMUtils.defineLazyModuleGetter(this, "PrivateBrowsingUtils",
+  "resource://gre/modules/PrivateBrowsingUtils.jsm");
+
 this.LightweightThemeConsumer =
  function LightweightThemeConsumer(aDocument) {
   this._doc = aDocument;
   this._win = aDocument.defaultView;
   this._footerId = aDocument.documentElement.getAttribute("lightweightthemesfooter");
 
+  if (PrivateBrowsingUtils.isWindowPrivate(this._win)) {
+    return;
+  }
+
   let screen = this._win.screen;
   this._lastScreenWidth = screen.width;
   this._lastScreenHeight = screen.height;
diff --git a/toolkit/content/PopupNotifications.jsm b/toolkit/content/PopupNotifications.jsm
index 67eee03d40e3..60b5ddf9bedc 100644
--- a/toolkit/content/PopupNotifications.jsm
+++ b/toolkit/content/PopupNotifications.jsm
@@ -68,6 +68,10 @@ Notification.prototype = {
                       iconBox;
 
     return anchorElement;
+  },
+
+  reshow: function() {
+    this.owner.reshow(this.anchorElement);
   }
 };
 
@@ -625,6 +629,10 @@ PopupNotifications.prototype = {
     while (anchor && anchor.parentNode != this.iconBox)
       anchor = anchor.parentNode;
 
+    this.reshow(anchor);
+  },
+
+  reshow: function PopupNotifications_reshow(anchor) {
     // Mark notifications anchored to this anchor as un-dismissed
     this._currentNotifications.forEach(function (n) {
       if (n.anchorElement == anchor)
diff --git a/toolkit/content/aboutTelemetry.js b/toolkit/content/aboutTelemetry.js
index 197e9e18be11..960521755eb6 100644
--- a/toolkit/content/aboutTelemetry.js
+++ b/toolkit/content/aboutTelemetry.js
@@ -734,7 +734,29 @@ function onLoad() {
 
   // Get the Telemetry Ping payload
   Telemetry.asyncFetchTelemetryData(displayPingData);
-}
+};
+
+let LateWritesSingleton = {
+  renderLateWrites: function LateWritesSingleton_renderLateWrites(lateWrites) {
+    let writesDiv = document.getElementById("late-writes-data");
+    clearDivData(writesDiv);
+    // FIXME: Add symbolication support. Refactor with the chrome hang one.
+
+    let stacks = lateWrites.stacks;
+    if (stacks.length == 0) {
+      showEmptySectionMessage("late-writes-section");
+      return;
+    }
+
+    let memoryMap = lateWrites.memoryMap;
+    StackRenderer.renderMemoryMap(writesDiv, memoryMap);
+
+    for (let i = 0; i < stacks.length; ++i) {
+      let stack = stacks[i];
+      StackRenderer.renderStack(writesDiv, stack);
+    }
+  }
+};
 
 function displayPingData() {
   let ping = TelemetryPing.getPayload();
@@ -746,6 +768,8 @@ function displayPingData() {
     showEmptySectionMessage("simple-measurements-section");
   }
 
+  LateWritesSingleton.renderLateWrites(ping.lateWrites);
+
   // Show basic system info gathered
   if (Object.keys(ping.info).length) {
     KeyValueTable.render("system-info-table", ping.info);
diff --git a/toolkit/content/aboutTelemetry.xhtml b/toolkit/content/aboutTelemetry.xhtml
index 3a93494f79ac..c846e244abd5 100644
--- a/toolkit/content/aboutTelemetry.xhtml
+++ b/toolkit/content/aboutTelemetry.xhtml
@@ -81,6 +81,20 @@
       </div>
     </section>
 
+    <section id="late-writes-section" class="data-section">
+      <h1 class="section-name">&aboutTelemetry.lateWritesSection;</h1>
+      <span class="toggle-caption">&aboutTelemetry.toggleOn;</span>
+      <span class="toggle-caption hidden">&aboutTelemetry.toggleOff;</span>
+      <span class="empty-caption hidden">&aboutTelemetry.emptySection;</span>
+      <div id="late-writes" class="data hidden">
+        <!-- FIXME: add fetch-symbols and hide-symbols -->
+        <br/>
+        <br/>
+        <div id="late-writes-data">
+        </div>
+      </div>
+    </section>
+
     <section id="system-info-section" class="data-section">
       <h1 class="section-name">&aboutTelemetry.systemInfoSection;</h1>
       <span class="toggle-caption">&aboutTelemetry.toggleOn;</span>
diff --git a/toolkit/content/widgets/button.xml b/toolkit/content/widgets/button.xml
index 1829f8b52494..0d53def2334e 100644
--- a/toolkit/content/widgets/button.xml
+++ b/toolkit/content/widgets/button.xml
@@ -340,6 +340,17 @@
       </method>
 
     </implementation>
+
+    <handlers>
+      <handler event="keypress" keycode="VK_RETURN">
+        if (event.originalTarget == this)
+          this.open = true;
+      </handler>
+      <handler event="keypress" key=" ">
+        if (event.originalTarget == this)
+          this.open = true;
+      </handler>
+    </handlers>
   </binding>
 
   <binding id="menu-button" display="xul:menu"
diff --git a/toolkit/identity/IdentityCryptoService.cpp b/toolkit/identity/IdentityCryptoService.cpp
index d476103ce658..802ba3c1b2ad 100644
--- a/toolkit/identity/IdentityCryptoService.cpp
+++ b/toolkit/identity/IdentityCryptoService.cpp
@@ -22,6 +22,8 @@
 #include "keyhi.h"
 #include "cryptohi.h"
 
+#include <limits.h>
+
 using namespace mozilla;
 
 namespace {
@@ -424,15 +426,15 @@ GenerateDSAKeyPair(PK11SlotInfo * slot,
     0x72,0xDF,0xFA,0x89,0x62,0x33,0x39,0x7A
   };
 
-  MOZ_STATIC_ASSERT(PR_ARRAY_SIZE(P) == 1024 / PR_BITS_PER_BYTE, "bad DSA P");
-  MOZ_STATIC_ASSERT(PR_ARRAY_SIZE(Q) ==  160 / PR_BITS_PER_BYTE, "bad DSA Q");
-  MOZ_STATIC_ASSERT(PR_ARRAY_SIZE(G) == 1024 / PR_BITS_PER_BYTE, "bad DSA G");
+  MOZ_STATIC_ASSERT(MOZ_ARRAY_LENGTH(P) == 1024 / CHAR_BIT, "bad DSA P");
+  MOZ_STATIC_ASSERT(MOZ_ARRAY_LENGTH(Q) ==  160 / CHAR_BIT, "bad DSA Q");
+  MOZ_STATIC_ASSERT(MOZ_ARRAY_LENGTH(G) == 1024 / CHAR_BIT, "bad DSA G");
 
   PQGParams pqgParams  = {
     NULL /*arena*/,
-    { siBuffer, P, PR_ARRAY_SIZE(P) },
-    { siBuffer, Q, PR_ARRAY_SIZE(Q) },
-    { siBuffer, G, PR_ARRAY_SIZE(G) }
+    { siBuffer, P, static_cast<unsigned int>(mozilla::ArrayLength(P)) },
+    { siBuffer, Q, static_cast<unsigned int>(mozilla::ArrayLength(Q)) },
+    { siBuffer, G, static_cast<unsigned int>(mozilla::ArrayLength(G)) }
   };
 
   return GenerateKeyPair(slot, privateKey, publicKey, CKM_DSA_KEY_PAIR_GEN,
diff --git a/toolkit/locales/en-US/chrome/global/aboutTelemetry.dtd b/toolkit/locales/en-US/chrome/global/aboutTelemetry.dtd
index 8233a499fb18..895f6f1a44ba 100644
--- a/toolkit/locales/en-US/chrome/global/aboutTelemetry.dtd
+++ b/toolkit/locales/en-US/chrome/global/aboutTelemetry.dtd
@@ -28,6 +28,10 @@
   Simple Measurements
 ">
 
+<!ENTITY aboutTelemetry.lateWritesSection "
+  Late Writes
+">
+
 <!ENTITY aboutTelemetry.systemInfoSection "
   System Information
 ">
diff --git a/toolkit/mozapps/downloads/nsHelperAppDlg.js b/toolkit/mozapps/downloads/nsHelperAppDlg.js
index abb6c4825ac8..91f21e7b0e89 100644
--- a/toolkit/mozapps/downloads/nsHelperAppDlg.js
+++ b/toolkit/mozapps/downloads/nsHelperAppDlg.js
@@ -109,7 +109,6 @@ function nsUnknownContentTypeDialog() {
   // Initialize data properties.
   this.mLauncher = null;
   this.mContext  = null;
-  this.mSourcePath = null;
   this.chosenApp = null;
   this.givenDefaultApp = false;
   this.updateSelf = true;
@@ -370,7 +369,10 @@ nsUnknownContentTypeDialog.prototype = {
     var suggestedFileName = this.mLauncher.suggestedFileName;
 
     // Some URIs do not implement nsIURL, so we can't just QI.
-    var url   = this.mLauncher.source;
+    var url = this.mLauncher.source;
+    if (url instanceof Components.interfaces.nsINestedURI)
+      url = url.innermostURI;
+
     var fname = "";
     var iconPath = "goat";
     this.mSourcePath = url.prePath;
@@ -514,28 +516,17 @@ nsUnknownContentTypeDialog.prototype = {
     this.dialogElement( "location" ).setAttribute("realname", filename);
     this.dialogElement( "location" ).setAttribute("tooltiptext", displayname);
 
-    // if mSourcePath is a local file, then let's use the pretty path name instead of an ugly
-    // url...
-    var pathString = this.mSourcePath;
-    try
-    {
-      var fileURL = url.QueryInterface(Components.interfaces.nsIFileURL);
-      if (fileURL)
-      {
-        var fileObject = fileURL.file;
-        if (fileObject)
-        {
-          var parentObject = fileObject.parent;
-          if (parentObject)
-          {
-            pathString = parentObject.path;
-          }
-        }
-      }
-    } catch(ex) {}
+    // if mSourcePath is a local file, then let's use the pretty path name
+    // instead of an ugly url...
+    var pathString;
+    if (url instanceof Components.interfaces.nsIFileURL) {
+      try {
+        // Getting .file might throw, or .parent could be null
+        pathString = url.file.parent.path;
+      } catch (ex) {}
+    }
 
-    if (pathString == this.mSourcePath)
-    {
+    if (!pathString) {
       // wasn't a fileURL
       var tmpurl = url.clone(); // don't want to change the real url
       try {
diff --git a/toolkit/mozapps/update/test/marionette/update_smoketest_ota_simple.js b/toolkit/mozapps/update/test/marionette/update_smoketest_ota_simple.js
index c5f714da7859..fee892fa8a52 100644
--- a/toolkit/mozapps/update/test/marionette/update_smoketest_ota_simple.js
+++ b/toolkit/mozapps/update/test/marionette/update_smoketest_ota_simple.js
@@ -11,24 +11,34 @@ function testForceCheck() {
 }
 
 function testDownload() {
-  let gotDownloading = false;
+  let gotStarted = false, gotProgress = false, gotStopped = false;
   let progress = 0, total = 0;
 
-  addChromeEventListener("update-downloading", function(evt) {
-    gotDownloading = true;
+  addChromeEventListener("update-download-started", function(evt) {
+    gotStarted = true;
     return true;
   });
-  addChromeEventListener("update-progress", function(evt) {
+  addChromeEventListener("update-download-progress", function(evt) {
     progress = evt.detail.progress;
     total = evt.detail.total;
+    gotProgress = true;
     if (total == progress) {
-      ok(gotDownloading);
+      ok(gotStarted);
       return true;
     }
     return false;
   });
+  addChromeEventListener("update-download-stopped", function(evt) {
+    is(evt.detail.paused, false);
+    gotStopped = true;
+    ok(gotStarted);
+    ok(gotProgress);
+    return true;
+  });
   addChromeEventListener("update-downloaded", function(evt) {
-    ok(gotDownloading);
+    ok(gotStarted);
+    ok(gotProgress);
+    ok(gotStopped);
     is(progress, total);
     return true;
   });
diff --git a/toolkit/mozapps/update/test/marionette/update_test_ota_simple.js b/toolkit/mozapps/update/test/marionette/update_test_ota_simple.js
index e63e603de5c1..c79a6ef4bd3b 100644
--- a/toolkit/mozapps/update/test/marionette/update_test_ota_simple.js
+++ b/toolkit/mozapps/update/test/marionette/update_test_ota_simple.js
@@ -13,24 +13,34 @@ function testForceCheck() {
 }
 
 function testDownload() {
-  let gotDownloading = false;
+  let gotStarted = false, gotProgress = false, gotStopped = false;
   let progress = 0, total = 0;
 
-  addChromeEventListener("update-downloading", function(evt) {
-    gotDownloading = true;
+  addChromeEventListener("update-download-started", function(evt) {
+    gotStarted = true;
     return true;
   });
-  addChromeEventListener("update-progress", function(evt) {
+  addChromeEventListener("update-download-progress", function(evt) {
     progress = evt.detail.progress;
     total = evt.detail.total;
+    gotProgress = true;
     if (total == progress) {
-      ok(gotDownloading);
+      ok(gotStarted);
       return true;
     }
     return false;
   });
+  addChromeEventListener("update-download-stopped", function(evt) {
+    is(evt.detail.paused, false);
+    gotStopped = true;
+    ok(gotStarted);
+    ok(gotProgress);
+    return true;
+  });
   addChromeEventListener("update-downloaded", function(evt) {
-    ok(gotDownloading);
+    ok(gotStarted);
+    ok(gotProgress);
+    ok(gotStopped);
     is(progress, total);
     return true;
   });
diff --git a/toolkit/profile/nsToolkitProfileService.cpp b/toolkit/profile/nsToolkitProfileService.cpp
index 9782ac541872..c03f6daf3fc8 100644
--- a/toolkit/profile/nsToolkitProfileService.cpp
+++ b/toolkit/profile/nsToolkitProfileService.cpp
@@ -859,7 +859,7 @@ nsToolkitProfileService::CreateTimesInternal(nsIFile* aProfileDir)
     NS_ENSURE_SUCCESS(rv, rv);
 
     // We don't care about microsecond resolution.
-    PRInt64 msec;
+    int64_t msec;
     LL_DIV(msec, PR_Now(), PR_USEC_PER_MSEC);
 
     // Write it out.
diff --git a/toolkit/themes/gnomestripe/global/global.css b/toolkit/themes/gnomestripe/global/global.css
index 602a2e7daab4..7166f479f0b6 100644
--- a/toolkit/themes/gnomestripe/global/global.css
+++ b/toolkit/themes/gnomestripe/global/global.css
@@ -268,10 +268,13 @@ label[disabled="true"] {
 
 .text-link {
   color: -moz-nativehyperlinktext;
-  text-decoration: underline;
   border: 1px solid transparent;
   cursor: pointer;
 }
+
+.text-link:hover {
+  text-decoration: underline;
+}
   
 .text-link:focus {
   border: 1px dotted -moz-DialogText;
diff --git a/toolkit/themes/pinstripe/global/console/console.css b/toolkit/themes/pinstripe/global/console/console.css
index f3ab26d02896..f00009cc4868 100644
--- a/toolkit/themes/pinstripe/global/console/console.css
+++ b/toolkit/themes/pinstripe/global/console/console.css
@@ -50,14 +50,6 @@
   padding-left: 6px;
 }
 
-.text-link {
-  text-decoration: none;  
-}
-
-.text-link:hover {
-  text-decoration: underline;
-}
-
 /* ..... error rows ..... */
 
 .console-row-code {
diff --git a/toolkit/themes/pinstripe/global/global.css b/toolkit/themes/pinstripe/global/global.css
index 0be212c96bda..013ca0f95cc9 100644
--- a/toolkit/themes/pinstripe/global/global.css
+++ b/toolkit/themes/pinstripe/global/global.css
@@ -239,10 +239,13 @@ description {
 
 .text-link {
   color: -moz-nativehyperlinktext;
-  text-decoration: underline;
   border: 1px solid transparent;
   cursor: pointer;
 }
+
+.text-link:hover {
+  text-decoration: underline;
+}
   
 .text-link:-moz-focusring {
   border: 1px dotted -moz-DialogText;
diff --git a/toolkit/themes/pinstripe/global/media/videocontrols.css b/toolkit/themes/pinstripe/global/media/videocontrols.css
index 26b73a94534d..8e92e73f91c0 100644
--- a/toolkit/themes/pinstripe/global/media/videocontrols.css
+++ b/toolkit/themes/pinstripe/global/media/videocontrols.css
@@ -10,41 +10,13 @@
   background-color: rgba(35,31,32,.74);
 }
 
-.playButton {
-  background: url(chrome://global/skin/media/pauseButton.png) no-repeat center;
-  /* Remove the native button appearance and styling */
-  -moz-appearance: none;
-  margin: 0;
-  padding: 0;
-  min-height: 28px;
-  min-width: 28px;
-  margin-right: -22px; /* 1/2 of scrubber thumb width, for overhang. */
-  position: relative; /* Trick to work around negative margin interfering with clicking on the button. */
-}
-.playButton[paused] {
-  background: url(chrome://global/skin/media/playButton.png) no-repeat center;
-}
-
-.muteButton {
-  background: url(chrome://global/skin/media/muteButton.png) no-repeat center;
-  /* Remove the native button appearance and styling */
-  -moz-appearance: none;
-  margin: 0;
-  padding: 0;
-  min-height: 28px;
-  min-width: 33px;
-}
-.muteButton[muted] {
-  background: url(chrome://global/skin/media/unmuteButton.png) no-repeat center;
-}
-
-.muteButton[noAudio] {
-  background: url(chrome://global/skin/media/noAudio.png) no-repeat center;
-}
-
+.playButton,
+.muteButton,
 .fullscreenButton {
-  background: -moz-image-rect(url("chrome://global/skin/media/fullscreenButton.png"), 0, 16, 16, 0) no-repeat center;
-  -moz-appearance: none;
+  background-color: transparent;
+  background-repeat: no-repeat;
+  background-position: center;
+  -moz-appearance: none;   /* Remove the native button appearance and styling */
   margin: 0;
   padding: 0;
   min-height: 28px;
@@ -52,6 +24,32 @@
   border: none;
 }
 
+.playButton {
+  background-image: url(chrome://global/skin/media/pauseButton.png);
+  margin-right: -22px; /* 1/2 of scrubber thumb width, for overhang. */
+  position: relative; /* Trick to work around negative margin interfering with clicking on the button. */
+}
+
+.playButton[paused] {
+  background-image: url(chrome://global/skin/media/playButton.png);
+}
+
+.muteButton {
+  background-image: url(chrome://global/skin/media/muteButton.png);
+  min-width: 33px;
+}
+.muteButton[muted] {
+  background-image: url(chrome://global/skin/media/unmuteButton.png);
+}
+
+.muteButton[noAudio] {
+  background-image: url(chrome://global/skin/media/noAudio.png);
+}
+
+.fullscreenButton {
+  background-image: -moz-image-rect(url("chrome://global/skin/media/fullscreenButton.png"), 0, 16, 16, 0);
+}
+
 .fullscreenButton[fullscreened] {
   background-image: -moz-image-rect(url("chrome://global/skin/media/fullscreenButton.png"), 0, 32, 16, 16);
 }
@@ -168,7 +166,7 @@
 }
 
 .timeThumb[showhours="true"] {
-  background: url(chrome://global/skin/media/scrubberThumbWide.png) no-repeat center;
+  background-image: url(chrome://global/skin/media/scrubberThumbWide.png);
 }
 
 .timeLabel {
diff --git a/toolkit/themes/winstripe/global/global.css b/toolkit/themes/winstripe/global/global.css
index 9a8ae59c2451..141839f394b2 100644
--- a/toolkit/themes/winstripe/global/global.css
+++ b/toolkit/themes/winstripe/global/global.css
@@ -282,11 +282,14 @@ label[disabled="true"]:-moz-system-metric(windows-classic) {
 
 .text-link {
   color: -moz-nativehyperlinktext;
-  text-decoration: underline;
   border: 1px solid transparent;
   cursor: pointer;
 }
 
+.text-link:hover {
+  text-decoration: underline;
+}
+
 .text-link:-moz-focusring {
   border: 1px dotted -moz-DialogText;
 }
diff --git a/toolkit/themes/winstripe/global/media/videocontrols.css b/toolkit/themes/winstripe/global/media/videocontrols.css
index 6a411588ec3a..271cc86b7c10 100644
--- a/toolkit/themes/winstripe/global/media/videocontrols.css
+++ b/toolkit/themes/winstripe/global/media/videocontrols.css
@@ -10,48 +10,44 @@
   background-color: rgba(35,31,32,.74);
 }
 
-.playButton {
-  background: url(chrome://global/skin/media/pauseButton.png) no-repeat center;
-  /* Remove the native button appearance and styling */
-  -moz-appearance: none;
+.playButton,
+.muteButton,
+.fullscreenButton {
+  background-color: transparent;
+  background-repeat: no-repeat;
+  background-position: center;
+  -moz-appearance: none;   /* Remove the native button appearance and styling */
   margin: 0;
   padding: 0;
   min-height: 28px;
   min-width: 28px;
   border: none;
+}
+
+.playButton {
+  background-image: url(chrome://global/skin/media/pauseButton.png);
   margin-right: -22px; /* 1/2 of scrubber thumb width, for overhang. */
   position: relative; /* Trick to work around negative margin interfering with clicking on the button. */
 }
+
 .playButton[paused] {
-  background: url(chrome://global/skin/media/playButton.png) no-repeat center;
+  background-image: url(chrome://global/skin/media/playButton.png);
 }
 
 .muteButton {
-  background: url(chrome://global/skin/media/muteButton.png) no-repeat center;
-  /* Remove the native button appearance and styling */
-  -moz-appearance: none;
-  margin: 0;
-  padding: 0;
-  min-height: 28px;
+  background-image: url(chrome://global/skin/media/muteButton.png);
   min-width: 33px;
-  border: none;
 }
 .muteButton[muted] {
-  background: url(chrome://global/skin/media/unmuteButton.png) no-repeat center;
+  background-image: url(chrome://global/skin/media/unmuteButton.png);
 }
 
 .muteButton[noAudio] {
-  background: url(chrome://global/skin/media/noAudio.png) no-repeat center;
+  background-image: url(chrome://global/skin/media/noAudio.png);
 }
 
 .fullscreenButton {
-  background: -moz-image-rect(url("chrome://global/skin/media/fullscreenButton.png"), 0, 16, 16, 0) no-repeat center;
-  -moz-appearance: none;
-  margin: 0;
-  padding: 0;
-  min-height: 28px;
-  min-width: 28px;
-  border: none;
+  background-image: -moz-image-rect(url("chrome://global/skin/media/fullscreenButton.png"), 0, 16, 16, 0);
 }
 
 .fullscreenButton[fullscreened] {
@@ -176,7 +172,7 @@
 }
 
 .timeThumb[showhours="true"] {
-  background: url(chrome://global/skin/media/scrubberThumbWide.png) no-repeat center;
+  background-image: url(chrome://global/skin/media/scrubberThumbWide.png);
 }
 
 .timeLabel {
diff --git a/uriloader/exthandler/nsExternalHelperAppService.cpp b/uriloader/exthandler/nsExternalHelperAppService.cpp
index ac59e44a3755..9f18a16571e7 100644
--- a/uriloader/exthandler/nsExternalHelperAppService.cpp
+++ b/uriloader/exthandler/nsExternalHelperAppService.cpp
@@ -381,8 +381,8 @@ static nsDefaultMimeTypeEntry defaultMimeEntries [] =
   { IMAGE_PNG, "png" },
   // -- end extensions used during startup
   { TEXT_CSS, "css" },
-  { IMAGE_JPG, "jpeg" },
-  { IMAGE_JPG, "jpg" },
+  { IMAGE_JPEG, "jpeg" },
+  { IMAGE_JPEG, "jpg" },
   { TEXT_HTML, "html" },
   { TEXT_HTML, "htm" },
   { APPLICATION_XPINSTALL, "xpi" },
@@ -460,7 +460,7 @@ static nsExtraMimeTypeEntry extraMimeEntries [] =
   { IMAGE_BMP, "bmp", "BMP Image" },
   { IMAGE_GIF, "gif", "GIF Image" },
   { IMAGE_ICO, "ico,cur", "ICO Image" },
-  { IMAGE_JPG, "jpeg,jpg,jfif,pjpeg,pjp", "JPEG Image" },
+  { IMAGE_JPEG, "jpeg,jpg,jfif,pjpeg,pjp", "JPEG Image" },
   { IMAGE_PNG, "png", "PNG Image" },
   { IMAGE_TIFF, "tiff,tif", "TIFF Image" },
   { IMAGE_XBM, "xbm", "XBM Image" },
diff --git a/widget/gonk/HwcComposer2D.cpp b/widget/gonk/HwcComposer2D.cpp
index f13a8b208027..30bd32a25c40 100644
--- a/widget/gonk/HwcComposer2D.cpp
+++ b/widget/gonk/HwcComposer2D.cpp
@@ -266,7 +266,7 @@ HwcComposer2D::PrepareLayerList(Layer* aLayer,
         container->SortChildrenBy3DZOrder(children);
 
         //FIXME/bug 810334
-        for (PRUint32 i = 0; i < children.Length(); i++) {
+        for (uint32_t i = 0; i < children.Length(); i++) {
             if (!PrepareLayerList(children[i], aClip)) {
                 return false;
             }
diff --git a/widget/windows/nsTextStore.cpp b/widget/windows/nsTextStore.cpp
index f529600132f7..87dfd50035bb 100644
--- a/widget/windows/nsTextStore.cpp
+++ b/widget/windows/nsTextStore.cpp
@@ -13,6 +13,9 @@
 #include "nscore.h"
 #include "nsTextStore.h"
 #include "nsWindow.h"
+#ifdef MOZ_METRO
+#include "winrt/MetroWidget.h"
+#endif
 #include "nsPrintfCString.h"
 #include "WinUtils.h"
 #include "mozilla/Preferences.h"
@@ -339,7 +342,6 @@ nsTextStore::nsTextStore()
   mRefCnt = 1;
   mEditCookie = 0;
   mSinkMask = 0;
-  mWindow = nullptr;
   mLock = 0;
   mLockQueued = 0;
   mTextChange.acpStart = INT32_MAX;
@@ -351,8 +353,8 @@ nsTextStore::~nsTextStore()
 {
   PR_LOG(sTextStoreLog, PR_LOG_ALWAYS,
     ("TSF: 0x%p nsTextStore instance is destroyed, "
-     "mWindow=0x%p, mDocumentMgr=0x%p, mContext=0x%p",
-     this, mWindow, mDocumentMgr.get(), mContext.get()));
+     "mWidget=0x%p, mDocumentMgr=0x%p, mContext=0x%p",
+     this, mWidget, mDocumentMgr, mContext));
 
   if (mCompositionTimer) {
     mCompositionTimer->Cancel();
@@ -362,12 +364,12 @@ nsTextStore::~nsTextStore()
 }
 
 bool
-nsTextStore::Create(nsWindow* aWindow,
+nsTextStore::Create(nsWindowBase* aWidget,
                     IMEState::Enabled aIMEEnabled)
 {
   PR_LOG(sTextStoreLog, PR_LOG_ALWAYS,
-    ("TSF: 0x%p nsTextStore::Create(aWindow=0x%p, aIMEEnabled=%s)",
-     this, aWindow, GetIMEEnabledName(aIMEEnabled)));
+    ("TSF: 0x%p nsTextStore::Create(aWidget=0x%p, aIMEEnabled=%s)",
+     this, aWidget, GetIMEEnabledName(aIMEEnabled)));
 
   if (mDocumentMgr) {
     PR_LOG(sTextStoreLog, PR_LOG_ERROR,
@@ -385,7 +387,8 @@ nsTextStore::Create(nsWindow* aWindow,
        "(0x%08X)", this, hr));
     return false;
   }
-  mWindow = aWindow;
+  mWidget = aWidget;
+
   // Create context and add it to document manager
   hr = mDocumentMgr->CreateContext(sTsfClientId, 0,
                                    static_cast<ITextStoreACP*>(this),
@@ -425,13 +428,13 @@ nsTextStore::Destroy(void)
   PR_LOG(sTextStoreLog, PR_LOG_ALWAYS,
     ("TSF: 0x%p nsTextStore::Destroy()", this));
 
-  if (mWindow) {
+  if (mWidget) {
     // When blurred, Tablet Input Panel posts "blur" messages
     // and try to insert text when the message is retrieved later.
     // But by that time the text store is already destroyed,
     // so try to get the message early
     MSG msg;
-    if (::PeekMessageW(&msg, mWindow->GetWindowHandle(),
+    if (::PeekMessageW(&msg, mWidget->GetWindowHandle(),
                        sFlushTIPInputMessage, sFlushTIPInputMessage,
                        PM_REMOVE)) {
       ::DispatchMessageW(&msg);
@@ -443,7 +446,7 @@ nsTextStore::Destroy(void)
     mDocumentMgr = NULL;
   }
   mSink = NULL;
-  mWindow = NULL;
+  mWidget = nullptr;
 
   PR_LOG(sTextStoreLog, PR_LOG_ALWAYS,
     ("TSF: 0x%p   nsTextStore::Destroy() succeeded", this));
@@ -756,9 +759,9 @@ nsTextStore::GetSelectionInternal(TS_SELECTION_ACP &aSelectionACP)
             "try to get normal selection...", this));
 
     // Construct and initialize an event to get selection info
-    nsQueryContentEvent event(true, NS_QUERY_SELECTED_TEXT, mWindow);
-    mWindow->InitEvent(event);
-    mWindow->DispatchWindowEvent(&event);
+    nsQueryContentEvent event(true, NS_QUERY_SELECTED_TEXT, mWidget);
+    mWidget->InitEvent(event);
+    mWidget->DispatchWindowEvent(&event);
     if (!event.mSucceeded) {
       PR_LOG(sTextStoreLog, PR_LOG_ERROR,
              ("TSF: 0x%p   nsTextStore::GetSelectionInternal() FAILED to "
@@ -1087,8 +1090,8 @@ nsTextStore::SendTextEventForCompositionString()
   }
 
   // Use NS_TEXT_TEXT to set composition string
-  nsTextEvent event(true, NS_TEXT_TEXT, mWindow);
-  mWindow->InitEvent(event);
+  nsTextEvent event(true, NS_TEXT_TEXT, mWidget);
+  mWidget->InitEvent(event);
 
   nsRefPtr<ITfRange> composingRange;
   hr = mCompositionView->GetRange(getter_AddRefs(composingRange));
@@ -1218,18 +1221,18 @@ nsTextStore::SendTextEventForCompositionString()
            ("TSF: 0x%p   nsTextStore::SendTextEventForCompositionString() "
             "dispatching compositionupdate event...", this));
     nsCompositionEvent compositionUpdate(true, NS_COMPOSITION_UPDATE,
-                                         mWindow);
-    mWindow->InitEvent(compositionUpdate);
+                                         mWidget);
+    mWidget->InitEvent(compositionUpdate);
     compositionUpdate.data = mCompositionString;
     mLastDispatchedCompositionString = mCompositionString;
-    mWindow->DispatchWindowEvent(&compositionUpdate);
+    mWidget->DispatchWindowEvent(&compositionUpdate);
   }
 
-  if (mWindow && !mWindow->Destroyed()) {
+  if (mWidget && !mWidget->Destroyed()) {
     PR_LOG(sTextStoreLog, PR_LOG_ALWAYS,
            ("TSF: 0x%p   nsTextStore::SendTextEventForCompositionString() "
             "dispatching text event...", this));
-    mWindow->DispatchWindowEvent(&event);
+    mWidget->DispatchWindowEvent(&event);
   }
 
   PR_LOG(sTextStoreLog, PR_LOG_ALWAYS,
@@ -1282,12 +1285,12 @@ nsTextStore::SetSelectionInternal(const TS_SELECTION_ACP* pSelection,
     }
     return S_OK;
   } else {
-    nsSelectionEvent event(true, NS_SELECTION_SET, mWindow);
+    nsSelectionEvent event(true, NS_SELECTION_SET, mWidget);
     event.mOffset = pSelection->acpStart;
     event.mLength = uint32_t(pSelection->acpEnd - pSelection->acpStart);
     event.mReversed = pSelection->style.ase == TS_AE_START;
-    mWindow->InitEvent(event);
-    mWindow->DispatchWindowEvent(&event);
+    mWidget->InitEvent(event);
+    mWidget->DispatchWindowEvent(&event);
     if (!event.mSucceeded) {
       PR_LOG(sTextStoreLog, PR_LOG_ERROR,
          ("TSF: 0x%p   nsTextStore::SetSelectionInternal() FAILED due to "
@@ -1415,10 +1418,10 @@ nsTextStore::GetText(LONG acpStart,
       }
     }
     // Send NS_QUERY_TEXT_CONTENT to get text content
-    nsQueryContentEvent event(true, NS_QUERY_TEXT_CONTENT, mWindow);
-    mWindow->InitEvent(event);
+    nsQueryContentEvent event(true, NS_QUERY_TEXT_CONTENT, mWidget);
+    mWidget->InitEvent(event);
     event.InitForQueryTextContent(uint32_t(acpStart), length);
-    mWindow->DispatchWindowEvent(&event);
+    mWidget->DispatchWindowEvent(&event);
     if (!event.mSucceeded) {
       PR_LOG(sTextStoreLog, PR_LOG_ERROR,
              ("TSF: 0x%p   nsTextStore::GetText() FAILED due to "
@@ -1693,11 +1696,11 @@ nsTextStore::GetEndACP(LONG *pacp)
   }
 
   // Flattened text is retrieved and its length returned
-  nsQueryContentEvent event(true, NS_QUERY_TEXT_CONTENT, mWindow);
-  mWindow->InitEvent(event);
+  nsQueryContentEvent event(true, NS_QUERY_TEXT_CONTENT, mWidget);
+  mWidget->InitEvent(event);
   // Return entire text
   event.InitForQueryTextContent(0, INT32_MAX);
-  mWindow->DispatchWindowEvent(&event);
+  mWidget->DispatchWindowEvent(&event);
   if (!event.mSucceeded) {
     PR_LOG(sTextStoreLog, PR_LOG_ERROR,
            ("TSF: 0x%p   nsTextStore::GetEndACP() FAILED due to "
@@ -1801,10 +1804,10 @@ nsTextStore::GetTextExt(TsViewCookie vcView,
   }
 
   // use NS_QUERY_TEXT_RECT to get rect in system, screen coordinates
-  nsQueryContentEvent event(true, NS_QUERY_TEXT_RECT, mWindow);
-  mWindow->InitEvent(event);
+  nsQueryContentEvent event(true, NS_QUERY_TEXT_RECT, mWidget);
+  mWidget->InitEvent(event);
   event.InitForQueryTextRect(acpStart, acpEnd - acpStart);
-  mWindow->DispatchWindowEvent(&event);
+  mWidget->DispatchWindowEvent(&event);
   if (!event.mSucceeded) {
     PR_LOG(sTextStoreLog, PR_LOG_ERROR,
            ("TSF: 0x%p   nsTextStore::GetTextExt() FAILED due to "
@@ -1817,19 +1820,21 @@ nsTextStore::GetTextExt(TsViewCookie vcView,
   if (event.mReply.mRect.height <= 0)
     event.mReply.mRect.height = 1;
 
-  // convert to unclipped screen rect
-  nsWindow* refWindow = static_cast<nsWindow*>(
-      event.mReply.mFocusedWidget ? event.mReply.mFocusedWidget : mWindow);
-  // Result rect is in top level widget coordinates
-  refWindow = refWindow->GetTopLevelWindow(false);
-  if (!refWindow) {
-    PR_LOG(sTextStoreLog, PR_LOG_ERROR,
-           ("TSF: 0x%p   nsTextStore::GetTextExt() FAILED due to "
-            "no top level window", this));
-    return E_FAIL;
-  }
+  if (XRE_GetWindowsEnvironment() == WindowsEnvironmentType_Desktop) {
+    // convert to unclipped screen rect
+    nsWindow* refWindow = static_cast<nsWindow*>(
+      event.mReply.mFocusedWidget ? event.mReply.mFocusedWidget : mWidget);
+    // Result rect is in top level widget coordinates
+    refWindow = refWindow->GetTopLevelWindow(false);
+    if (!refWindow) {
+      PR_LOG(sTextStoreLog, PR_LOG_ERROR,
+             ("TSF: 0x%p   nsTextStore::GetTextExt() FAILED due to "
+              "no top level window", this));
+      return E_FAIL;
+    }
 
-  event.mReply.mRect.MoveBy(refWindow->WidgetToScreenOffset());
+    event.mReply.mRect.MoveBy(refWindow->WidgetToScreenOffset());
+  }
 
   // get bounding screen rect to test for clipping
   if (!GetScreenExtInternal(*prc)) {
@@ -1902,9 +1907,9 @@ nsTextStore::GetScreenExtInternal(RECT &aScreenExt)
          ("TSF: 0x%p   nsTextStore::GetScreenExtInternal()", this));
 
   // use NS_QUERY_EDITOR_RECT to get rect in system, screen coordinates
-  nsQueryContentEvent event(true, NS_QUERY_EDITOR_RECT, mWindow);
-  mWindow->InitEvent(event);
-  mWindow->DispatchWindowEvent(&event);
+  nsQueryContentEvent event(true, NS_QUERY_EDITOR_RECT, mWidget);
+  mWidget->InitEvent(event);
+  mWidget->DispatchWindowEvent(&event);
   if (!event.mSucceeded) {
     PR_LOG(sTextStoreLog, PR_LOG_ERROR,
            ("TSF: 0x%p   nsTextStore::GetScreenExtInternal() FAILED due to "
@@ -1912,35 +1917,50 @@ nsTextStore::GetScreenExtInternal(RECT &aScreenExt)
     return false;
   }
 
-  nsWindow* refWindow = static_cast<nsWindow*>(
-      event.mReply.mFocusedWidget ? event.mReply.mFocusedWidget : mWindow);
-  // Result rect is in top level widget coordinates
-  refWindow = refWindow->GetTopLevelWindow(false);
-  if (!refWindow) {
-    PR_LOG(sTextStoreLog, PR_LOG_ERROR,
-           ("TSF: 0x%p   nsTextStore::GetScreenExtInternal() FAILED due to "
-            "no top level window", this));
-    return false;
-  }
-
-  nsIntRect boundRect;
-  if (NS_FAILED(refWindow->GetClientBounds(boundRect))) {
-    PR_LOG(sTextStoreLog, PR_LOG_ERROR,
-           ("TSF: 0x%p   nsTextStore::GetScreenExtInternal() FAILED due to "
-            "failed to get the client bounds", this));
-    return false;
-  }
-
-  boundRect.MoveTo(0, 0);
-
-  // Clip frame rect to window rect
-  boundRect.IntersectRect(event.mReply.mRect, boundRect);
-  if (!boundRect.IsEmpty()) {
-    boundRect.MoveBy(refWindow->WidgetToScreenOffset());
+  if (XRE_GetWindowsEnvironment() == WindowsEnvironmentType_Metro) {
+    nsIntRect boundRect;
+    if (NS_FAILED(mWidget->GetClientBounds(boundRect))) {
+      PR_LOG(sTextStoreLog, PR_LOG_ERROR,
+             ("TSF: 0x%p   nsTextStore::GetScreenExtInternal() FAILED due to "
+              "failed to get the client bounds", this));
+      return false;
+    }
     ::SetRect(&aScreenExt, boundRect.x, boundRect.y,
               boundRect.XMost(), boundRect.YMost());
   } else {
-    ::SetRectEmpty(&aScreenExt);
+    NS_ASSERTION(XRE_GetWindowsEnvironment() == WindowsEnvironmentType_Desktop,
+                 "environment isn't WindowsEnvironmentType_Desktop!");
+    nsWindow* refWindow = static_cast<nsWindow*>(
+      event.mReply.mFocusedWidget ?
+        event.mReply.mFocusedWidget : mWidget);
+    // Result rect is in top level widget coordinates
+    refWindow = refWindow->GetTopLevelWindow(false);
+    if (!refWindow) {
+      PR_LOG(sTextStoreLog, PR_LOG_ERROR,
+             ("TSF: 0x%p   nsTextStore::GetScreenExtInternal() FAILED due to "
+              "no top level window", this));
+      return false;
+    }
+
+    nsIntRect boundRect;
+    if (NS_FAILED(refWindow->GetClientBounds(boundRect))) {
+      PR_LOG(sTextStoreLog, PR_LOG_ERROR,
+             ("TSF: 0x%p   nsTextStore::GetScreenExtInternal() FAILED due to "
+              "failed to get the client bounds", this));
+      return false;
+    }
+
+    boundRect.MoveTo(0, 0);
+
+    // Clip frame rect to window rect
+    boundRect.IntersectRect(event.mReply.mRect, boundRect);
+    if (!boundRect.IsEmpty()) {
+      boundRect.MoveBy(refWindow->WidgetToScreenOffset());
+      ::SetRect(&aScreenExt, boundRect.x, boundRect.y,
+                boundRect.XMost(), boundRect.YMost());
+    } else {
+      ::SetRectEmpty(&aScreenExt);
+    }
   }
 
   PR_LOG(sTextStoreLog, PR_LOG_DEBUG,
@@ -1956,8 +1976,9 @@ nsTextStore::GetWnd(TsViewCookie vcView,
                     HWND *phwnd)
 {
   PR_LOG(sTextStoreLog, PR_LOG_ALWAYS,
-         ("TSF: 0x%p nsTextStore::GetWnd(vcView=%ld, phwnd=0x%p), mWindow=0x%p",
-          this, vcView, phwnd, mWindow));
+         ("TSF: 0x%p nsTextStore::GetWnd(vcView=%ld, phwnd=0x%p), "
+          "mWidget=0x%p",
+          this, vcView, phwnd, mWidget));
 
   if (vcView != TEXTSTORE_DEFAULT_VIEW) {
     PR_LOG(sTextStoreLog, PR_LOG_ERROR,
@@ -1973,7 +1994,7 @@ nsTextStore::GetWnd(TsViewCookie vcView,
     return E_INVALIDARG;
   }
 
-  *phwnd = mWindow->GetWindowHandle();
+  *phwnd = mWidget->GetWindowHandle();
 
   PR_LOG(sTextStoreLog, PR_LOG_ALWAYS,
          ("TSF: 0x%p   nsTextStore::GetWnd() succeeded: *phwnd=0x%p",
@@ -2135,10 +2156,11 @@ nsTextStore::InsertTextAtSelectionInternal(const nsAString &aInsertStr,
     PR_LOG(sTextStoreLog, PR_LOG_DEBUG,
            ("TSF: 0x%p   nsTextStore::InsertTextAtSelectionInternal() "
             "dispatching a compositionstart event...", this));
-    nsCompositionEvent compStartEvent(true, NS_COMPOSITION_START, mWindow);
-    mWindow->InitEvent(compStartEvent);
-    mWindow->DispatchWindowEvent(&compStartEvent);
-    if (!mWindow || mWindow->Destroyed()) {
+    nsCompositionEvent compStartEvent(true, NS_COMPOSITION_START,
+                                      mWidget);
+    mWidget->InitEvent(compStartEvent);
+    mWidget->DispatchWindowEvent(&compStartEvent);
+    if (!mWidget || mWidget->Destroyed()) {
       PR_LOG(sTextStoreLog, PR_LOG_ERROR,
              ("TSF: 0x%p   nsTextStore::InsertTextAtSelectionInternal() FAILED "
               "due to the widget destroyed by compositionstart event", this));
@@ -2149,10 +2171,11 @@ nsTextStore::InsertTextAtSelectionInternal(const nsAString &aInsertStr,
     PR_LOG(sTextStoreLog, PR_LOG_DEBUG,
            ("TSF: 0x%p   nsTextStore::InsertTextAtSelectionInternal() "
             "dispatching a compositionupdate event...", this));
-      nsCompositionEvent compUpdateEvent(true, NS_COMPOSITION_UPDATE, mWindow);
+      nsCompositionEvent compUpdateEvent(true, NS_COMPOSITION_UPDATE,
+                                         mWidget);
       compUpdateEvent.data = aInsertStr;
-      mWindow->DispatchWindowEvent(&compUpdateEvent);
-      if (!mWindow || mWindow->Destroyed()) {
+      mWidget->DispatchWindowEvent(&compUpdateEvent);
+      if (!mWidget || mWidget->Destroyed()) {
         PR_LOG(sTextStoreLog, PR_LOG_ERROR,
                ("TSF: 0x%p   nsTextStore::InsertTextAtSelectionInternal() "
                 "FAILED due to the widget destroyed by compositionupdate event",
@@ -2164,13 +2187,13 @@ nsTextStore::InsertTextAtSelectionInternal(const nsAString &aInsertStr,
     PR_LOG(sTextStoreLog, PR_LOG_DEBUG,
            ("TSF: 0x%p   nsTextStore::InsertTextAtSelectionInternal() "
             "dispatching a text event...", this));
-    nsTextEvent textEvent(true, NS_TEXT_TEXT, mWindow);
-    mWindow->InitEvent(textEvent);
+    nsTextEvent textEvent(true, NS_TEXT_TEXT, mWidget);
+    mWidget->InitEvent(textEvent);
     textEvent.theText = aInsertStr;
     textEvent.theText.ReplaceSubstring(NS_LITERAL_STRING("\r\n"),
                                        NS_LITERAL_STRING("\n"));
-    mWindow->DispatchWindowEvent(&textEvent);
-    if (!mWindow || mWindow->Destroyed()) {
+    mWidget->DispatchWindowEvent(&textEvent);
+    if (!mWidget || mWidget->Destroyed()) {
       PR_LOG(sTextStoreLog, PR_LOG_ERROR,
              ("TSF: 0x%p   nsTextStore::InsertTextAtSelectionInternal() FAILED "
               "due to the widget destroyed by text event", this));
@@ -2180,10 +2203,10 @@ nsTextStore::InsertTextAtSelectionInternal(const nsAString &aInsertStr,
     PR_LOG(sTextStoreLog, PR_LOG_DEBUG,
            ("TSF: 0x%p   nsTextStore::InsertTextAtSelectionInternal() "
             "dispatching a compositionend event...", this));
-    nsCompositionEvent compEndEvent(true, NS_COMPOSITION_END, mWindow);
+    nsCompositionEvent compEndEvent(true, NS_COMPOSITION_END, mWidget);
     compEndEvent.data = aInsertStr;
-    mWindow->DispatchWindowEvent(&compEndEvent);
-    if (!mWindow || mWindow->Destroyed()) {
+    mWidget->DispatchWindowEvent(&compEndEvent);
+    if (!mWidget || mWidget->Destroyed()) {
       PR_LOG(sTextStoreLog, PR_LOG_ERROR,
              ("TSF: 0x%p   nsTextStore::InsertTextAtSelectionInternal() FAILED "
               "due to the widget destroyed by compositionend event", this));
@@ -2209,9 +2232,9 @@ nsTextStore::InsertTextAtSelectionInternal(const nsAString &aInsertStr,
 
   PR_LOG(sTextStoreLog, PR_LOG_DEBUG,
          ("TSF: 0x%p   nsTextStore::InsertTextAtSelectionInternal() succeeded: "
-          "mWindow=0x%p, mWindow->Destroyed()=%s, aTextChange={ acpStart=%ld, "
+          "mWidget=0x%p, mWidget->Destroyed()=%s, aTextChange={ acpStart=%ld, "
           "acpOldEnd=%ld, acpNewEnd=%ld }",
-          this, mWindow, GetBoolName(mWindow ? mWindow->Destroyed() : true),
+          this, mWidget, GetBoolName(mWidget ? mWidget->Destroyed() : true),
           aTextChange ? aTextChange->acpStart : 0,
           aTextChange ? aTextChange->acpOldEnd : 0,
           aTextChange ? aTextChange->acpNewEnd : 0));
@@ -2264,12 +2287,12 @@ nsTextStore::OnStartCompositionInternal(ITfCompositionView* pComposition,
           "dispatching selectionset event..."));
 
   // Select composition range so the new composition replaces the range
-  nsSelectionEvent selEvent(true, NS_SELECTION_SET, mWindow);
-  mWindow->InitEvent(selEvent);
+  nsSelectionEvent selEvent(true, NS_SELECTION_SET, mWidget);
+  mWidget->InitEvent(selEvent);
   selEvent.mOffset = uint32_t(mCompositionStart);
   selEvent.mLength = uint32_t(mCompositionLength);
   selEvent.mReversed = false;
-  mWindow->DispatchWindowEvent(&selEvent);
+  mWidget->DispatchWindowEvent(&selEvent);
   if (!selEvent.mSucceeded) {
     PR_LOG(sTextStoreLog, PR_LOG_ERROR,
            ("TSF: 0x%p   nsTextStore::OnStartCompositionInternal() FAILED due "
@@ -2278,9 +2301,9 @@ nsTextStore::OnStartCompositionInternal(ITfCompositionView* pComposition,
   }
 
   // Set up composition
-  nsQueryContentEvent queryEvent(true, NS_QUERY_SELECTED_TEXT, mWindow);
-  mWindow->InitEvent(queryEvent);
-  mWindow->DispatchWindowEvent(&queryEvent);
+  nsQueryContentEvent queryEvent(true, NS_QUERY_SELECTED_TEXT, mWidget);
+  mWidget->InitEvent(queryEvent);
+  mWidget->DispatchWindowEvent(&queryEvent);
   if (!queryEvent.mSucceeded) {
     PR_LOG(sTextStoreLog, PR_LOG_ERROR,
            ("TSF: 0x%p   nsTextStore::OnStartCompositionInternal() FAILED due "
@@ -2299,9 +2322,9 @@ nsTextStore::OnStartCompositionInternal(ITfCompositionView* pComposition,
     mCompositionSelection.style.ase = TS_AE_END;
     mCompositionSelection.style.fInterimChar = FALSE;
   }
-  nsCompositionEvent event(true, NS_COMPOSITION_START, mWindow);
-  mWindow->InitEvent(event);
-  mWindow->DispatchWindowEvent(&event);
+  nsCompositionEvent event(true, NS_COMPOSITION_START, mWidget);
+  mWidget->InitEvent(event);
+  mWidget->DispatchWindowEvent(&event);
 
   PR_LOG(sTextStoreLog, PR_LOG_DEBUG,
          ("TSF: 0x%p   nsTextStore::OnStartCompositionInternal() succeeded: "
@@ -2476,12 +2499,12 @@ nsTextStore::OnEndComposition(ITfCompositionView* pComposition)
            ("TSF: 0x%p   nsTextStore::OnEndComposition(), "
             "dispatching compositionupdate event...", this));
     nsCompositionEvent compositionUpdate(true, NS_COMPOSITION_UPDATE,
-                                         mWindow);
-    mWindow->InitEvent(compositionUpdate);
+                                         mWidget);
+    mWidget->InitEvent(compositionUpdate);
     compositionUpdate.data = mCompositionString;
     mLastDispatchedCompositionString = mCompositionString;
-    mWindow->DispatchWindowEvent(&compositionUpdate);
-    if (!mWindow || mWindow->Destroyed()) {
+    mWidget->DispatchWindowEvent(&compositionUpdate);
+    if (!mWidget || mWidget->Destroyed()) {
       PR_LOG(sTextStoreLog, PR_LOG_ALWAYS,
              ("TSF: 0x%p   nsTextStore::OnEndComposition(), "
               "succeeded, but the widget has gone", this));
@@ -2494,14 +2517,14 @@ nsTextStore::OnEndComposition(ITfCompositionView* pComposition)
           "dispatching text event...", this));
 
   // Use NS_TEXT_TEXT to commit composition string
-  nsTextEvent textEvent(true, NS_TEXT_TEXT, mWindow);
-  mWindow->InitEvent(textEvent);
+  nsTextEvent textEvent(true, NS_TEXT_TEXT, mWidget);
+  mWidget->InitEvent(textEvent);
   textEvent.theText = mCompositionString;
   textEvent.theText.ReplaceSubstring(NS_LITERAL_STRING("\r\n"),
                                      NS_LITERAL_STRING("\n"));
-  mWindow->DispatchWindowEvent(&textEvent);
+  mWidget->DispatchWindowEvent(&textEvent);
 
-  if (!mWindow || mWindow->Destroyed()) {
+  if (!mWidget || mWidget->Destroyed()) {
     PR_LOG(sTextStoreLog, PR_LOG_ALWAYS,
            ("TSF: 0x%p   nsTextStore::OnEndComposition(), "
             "succeeded, but the widget has gone", this));
@@ -2512,12 +2535,12 @@ nsTextStore::OnEndComposition(ITfCompositionView* pComposition)
          ("TSF: 0x%p   nsTextStore::OnEndComposition(), "
           "dispatching compositionend event...", this));
 
-  nsCompositionEvent event(true, NS_COMPOSITION_END, mWindow);
+  nsCompositionEvent event(true, NS_COMPOSITION_END, mWidget);
   event.data = mLastDispatchedCompositionString;
-  mWindow->InitEvent(event);
-  mWindow->DispatchWindowEvent(&event);
+  mWidget->InitEvent(event);
+  mWidget->DispatchWindowEvent(&event);
 
-  if (!mWindow || mWindow->Destroyed()) {
+  if (!mWidget || mWidget->Destroyed()) {
     PR_LOG(sTextStoreLog, PR_LOG_ALWAYS,
            ("TSF: 0x%p   nsTextStore::OnEndComposition(), "
             "succeeded, but the widget has gone", this));
@@ -2538,22 +2561,24 @@ nsTextStore::OnEndComposition(ITfCompositionView* pComposition)
 
 // static
 nsresult
-nsTextStore::OnFocusChange(bool aFocus,
-                           nsWindow* aWindow,
+nsTextStore::OnFocusChange(bool aGotFocus,
+                           nsWindowBase* aFocusedWidget,
                            IMEState::Enabled aIMEEnabled)
 {
   PR_LOG(sTextStoreLog, PR_LOG_DEBUG,
-         ("TSF: nsTextStore::OnFocusChange(aFocus=%s, aWindow=0x%p, "
-          "aIMEEnabled=%s), sTsfThreadMgr=0x%p, sTsfTextStore=0x%p",
-          GetBoolName(aFocus), aWindow, GetIMEEnabledName(aIMEEnabled),
-          sTsfThreadMgr, sTsfTextStore));
+         ("TSF: nsTextStore::OnFocusChange(aGotFocus=%s, "
+          "aFocusedWidget=0x%p, aIMEEnabled=%s), sTsfThreadMgr=0x%p, "
+          "sTsfTextStore=0x%p",
+          GetBoolName(aGotFocus), aFocusedWidget,
+          GetIMEEnabledName(aIMEEnabled), sTsfThreadMgr, sTsfTextStore));
 
   // no change notifications if TSF is disabled
-  if (!sTsfThreadMgr || !sTsfTextStore)
+  if (!sTsfThreadMgr || !sTsfTextStore) {
     return NS_ERROR_NOT_AVAILABLE;
+  }
 
-  if (aFocus) {
-    bool bRet = sTsfTextStore->Create(aWindow, aIMEEnabled);
+  if (aGotFocus) {
+    bool bRet = sTsfTextStore->Create(aFocusedWidget, aIMEEnabled);
     NS_ENSURE_TRUE(bRet, NS_ERROR_FAILURE);
     NS_ENSURE_TRUE(sTsfTextStore->mDocumentMgr, NS_ERROR_FAILURE);
     HRESULT hr = sTsfThreadMgr->SetFocus(sTsfTextStore->mDocumentMgr);
@@ -2594,7 +2619,7 @@ nsTextStore::OnTextChangeInternal(uint32_t aStart,
     mTextChange.acpStart = NS_MIN(mTextChange.acpStart, LONG(aStart));
     mTextChange.acpOldEnd = NS_MAX(mTextChange.acpOldEnd, LONG(aOldEnd));
     mTextChange.acpNewEnd = NS_MAX(mTextChange.acpNewEnd, LONG(aNewEnd));
-    ::PostMessageW(mWindow->GetWindowHandle(),
+    ::PostMessageW(mWidget->GetWindowHandle(),
                    WM_USER_TSF_TEXTCHANGE, 0, 0);
   }
   return NS_OK;
diff --git a/widget/windows/nsTextStore.h b/widget/windows/nsTextStore.h
index 832b87ccc058..b04d819806c2 100644
--- a/widget/windows/nsTextStore.h
+++ b/widget/windows/nsTextStore.h
@@ -11,6 +11,7 @@
 #include "nsCOMPtr.h"
 #include "nsITimer.h"
 #include "nsIWidget.h"
+#include "nsWindowBase.h"
 #include "mozilla/Attributes.h"
 
 #include <msctf.h>
@@ -22,6 +23,9 @@ struct ITfDisplayAttributeMgr;
 struct ITfCategoryMgr;
 class nsWindow;
 class nsTextEvent;
+#ifdef MOZ_METRO
+class MetroWidget;
+#endif
 
 // It doesn't work well when we notify TSF of text change
 // during a mutation observer call because things get broken.
@@ -100,8 +104,9 @@ public:
     sTsfTextStore->SetInputContextInternal(aContext.mIMEState.mEnabled);
   }
 
-  static nsresult OnFocusChange(bool, nsWindow*, IMEState::Enabled);
-
+  static nsresult OnFocusChange(bool aGotFocus,
+                                nsWindowBase* aFocusedWidget,
+                                IMEState::Enabled aIMEEnabled);
   static nsresult OnTextChange(uint32_t aStart,
                                uint32_t aOldEnd,
                                uint32_t aNewEnd)
@@ -154,7 +159,8 @@ protected:
   nsTextStore();
   ~nsTextStore();
 
-  bool     Create(nsWindow*, IMEState::Enabled);
+  bool     Create(nsWindowBase* aWidget,
+                  IMEState::Enabled aIMEEnabled);
   bool     Destroy(void);
 
   bool     IsReadLock(DWORD aLock) const
@@ -192,6 +198,8 @@ protected:
   HRESULT  SaveTextEvent(const nsTextEvent* aEvent);
   nsresult OnCompositionTimer();
 
+  // Holds the pointer to our current win32 or metro widget
+  nsRefPtr<nsWindowBase>       mWidget;
   // Document manager for the currently focused editor
   nsRefPtr<ITfDocumentMgr>     mDocumentMgr;
   // Edit cookie associated with the current editing context
@@ -202,8 +210,6 @@ protected:
   nsRefPtr<ITextStoreACPSink>  mSink;
   // TS_AS_* mask of what events to notify
   DWORD                        mSinkMask;
-  // Window containing the focused editor
-  nsWindow*                    mWindow;
   // 0 if not locked, otherwise TS_LF_* indicating the current lock
   DWORD                        mLock;
   // 0 if no lock is queued, otherwise TS_LF_* indicating the queue lock
diff --git a/widget/windows/nsWindow.cpp b/widget/windows/nsWindow.cpp
index a88cbf3e027f..14ae0ec4b3a8 100644
--- a/widget/windows/nsWindow.cpp
+++ b/widget/windows/nsWindow.cpp
@@ -302,7 +302,7 @@ static const int32_t kResizableBorderMinSize = 3;
  *
  **************************************************************/
 
-nsWindow::nsWindow() : nsBaseWidget()
+nsWindow::nsWindow() : nsWindowBase()
 {
 #ifdef PR_LOGGING
   if (!gWindowsLog) {
@@ -5046,7 +5046,9 @@ bool nsWindow::ProcessMessage(UINT msg, WPARAM &wParam, LPARAM &lParam,
     case WM_APPCOMMAND:
     {
       uint32_t appCommand = GET_APPCOMMAND_LPARAM(lParam);
-
+      uint32_t contentCommandMessage = NS_EVENT_NULL;
+      // XXX After we implement KeyboardEvent.key, we should dispatch the
+      //     key event if (GET_DEVICE_LPARAM(lParam) == FAPPCOMMAND_KEY) is.
       switch (appCommand)
       {
         case APPCOMMAND_BROWSER_BACKWARD:
@@ -5075,6 +5077,31 @@ bool nsWindow::ProcessMessage(UINT msg, WPARAM &wParam, LPARAM &lParam,
             result = true;
           }
           break;
+
+        // Use content command for following commands:
+        case APPCOMMAND_COPY:
+          contentCommandMessage = NS_CONTENT_COMMAND_COPY;
+          break;
+        case APPCOMMAND_CUT:
+          contentCommandMessage = NS_CONTENT_COMMAND_CUT;
+          break;
+        case APPCOMMAND_PASTE:
+          contentCommandMessage = NS_CONTENT_COMMAND_PASTE;
+          break;
+        case APPCOMMAND_REDO:
+          contentCommandMessage = NS_CONTENT_COMMAND_REDO;
+          break;
+        case APPCOMMAND_UNDO:
+          contentCommandMessage = NS_CONTENT_COMMAND_UNDO;
+          break;
+      }
+
+      if (contentCommandMessage) {
+        nsContentCommandEvent contentCommand(true, contentCommandMessage, this);
+        DispatchWindowEvent(&contentCommand);
+        // tell the driver that we handled the event
+        *aRetValue = 1;
+        result = true;
       }
       // default = false - tell the driver that the event was not handled
     }
diff --git a/widget/windows/nsWindow.h b/widget/windows/nsWindow.h
index 763a5badb024..5fca2e5af4c8 100644
--- a/widget/windows/nsWindow.h
+++ b/widget/windows/nsWindow.h
@@ -12,6 +12,7 @@
 
 #include "nsAutoPtr.h"
 #include "nsBaseWidget.h"
+#include "nsWindowBase.h"
 #include "nsdefs.h"
 #include "nsIdleService.h"
 #include "nsToolkit.h"
@@ -64,7 +65,7 @@ class ModifierKeyState;
  * Native WIN32 window wrapper.
  */
 
-class nsWindow : public nsBaseWidget
+class nsWindow : public nsWindowBase
 {
   typedef mozilla::TimeStamp TimeStamp;
   typedef mozilla::TimeDuration TimeDuration;
@@ -79,9 +80,11 @@ public:
 
   friend class nsWindowGfx;
 
-  /**
-   * nsIWidget interface
-   */
+  // nsWindowBase
+  virtual void InitEvent(nsGUIEvent& aEvent, nsIntPoint* aPoint = nullptr) MOZ_OVERRIDE;
+  virtual bool DispatchWindowEvent(nsGUIEvent* aEvent) MOZ_OVERRIDE;
+
+  // nsIWidget interface
   NS_IMETHOD              Create(nsIWidget *aParent,
                                  nsNativeWidget aNativeParent,
                                  const nsIntRect &aRect,
@@ -186,13 +189,11 @@ public:
   /**
    * Event helpers
    */
-  void                    InitEvent(nsGUIEvent& event, nsIntPoint* aPoint = nullptr);
   virtual bool            DispatchMouseEvent(uint32_t aEventType, WPARAM wParam,
                                              LPARAM lParam,
                                              bool aIsContextMenuKey = false,
                                              int16_t aButton = nsMouseEvent::eLeftButton,
                                              uint16_t aInputSource = nsIDOMMouseEvent::MOZ_SOURCE_MOUSE);
-  virtual bool            DispatchWindowEvent(nsGUIEvent* event);
   virtual bool            DispatchWindowEvent(nsGUIEvent*event, nsEventStatus &aStatus);
   void                    InitKeyEvent(nsKeyEvent& aKeyEvent,
                                        const NativeKey& aNativeKey,
@@ -215,7 +216,6 @@ public:
    * Window utilities
    */
   nsWindow*               GetTopLevelWindow(bool aStopOnDialogOrPopup);
-  HWND                    GetWindowHandle() { return mWnd; }
   WNDPROC                 GetPrevWindowProc() { return mPrevWndProc; }
   WindowHook&             GetWindowHook() { return mWindowHook; }
   nsWindow*               GetParentWindow(bool aIncludeOwner);
diff --git a/widget/windows/nsWindowBase.h b/widget/windows/nsWindowBase.h
new file mode 100644
index 000000000000..38643b63e3a2
--- /dev/null
+++ b/widget/windows/nsWindowBase.h
@@ -0,0 +1,37 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef nsWindowBase_h_
+#define nsWindowBase_h_
+
+#include "nsBaseWidget.h"
+
+/*
+ * nsWindowBase - Base class of common methods other classes need to access
+ * in both win32 and winrt window classes.
+ */
+
+class nsWindowBase : public nsBaseWidget
+{
+public:
+  /*
+   * Return the HWND or null for this widget.
+   */
+  virtual HWND GetWindowHandle() MOZ_FINAL {
+    return static_cast<HWND>(GetNativeData(NS_NATIVE_WINDOW));
+  }
+
+  /*
+   * Init a standard gecko event for this widget.
+   */
+  virtual void InitEvent(nsGUIEvent& aEvent, nsIntPoint* aPoint = nullptr) = 0;
+
+  /*
+   * Dispatch a gecko event for this widget.
+   */
+  virtual bool DispatchWindowEvent(nsGUIEvent* aEvent) = 0;
+};
+
+#endif // nsWindowBase_h_
diff --git a/xpcom/base/nsCycleCollector.cpp b/xpcom/base/nsCycleCollector.cpp
index 5e9bda0a6bbd..80e1290c55fd 100644
--- a/xpcom/base/nsCycleCollector.cpp
+++ b/xpcom/base/nsCycleCollector.cpp
@@ -1070,7 +1070,7 @@ struct nsCycleCollector
     // Prepare for and cleanup after one or more collection(s).
     bool PrepareForCollection(nsCycleCollectorResults *aResults,
                               nsTArray<PtrInfo*> *aWhiteNodes);
-    void GCIfNeeded(bool aForceGC);
+    void FixGrayBits(bool aForceGC);
     void CleanupAfterCollection();
 
     // Start and finish an individual collection.
@@ -2699,10 +2699,10 @@ nsCycleCollector::LogPurpleRemoval(void* aObject)
 // and also when UnmarkGray has run out of stack.  We also force GCs on shut 
 // down to collect cycles involving both DOM and JS.
 void
-nsCycleCollector::GCIfNeeded(bool aForceGC)
+nsCycleCollector::FixGrayBits(bool aForceGC)
 {
     MOZ_ASSERT(NS_IsMainThread(),
-               "nsCycleCollector::GCIfNeeded() must be called on the main thread.");
+               "nsCycleCollector::FixGrayBits() must be called on the main thread.");
 
     if (mParams.mDoNothing)
         return;
@@ -2711,6 +2711,8 @@ nsCycleCollector::GCIfNeeded(bool aForceGC)
         return;
 
     if (!aForceGC) {
+        mJSRuntime->FixWeakMappingGrayBits();
+
         bool needGC = mJSRuntime->NeedCollect();
         // Only do a telemetry ping for non-shutdown CCs.
         Telemetry::Accumulate(Telemetry::CYCLE_COLLECTOR_NEED_GC, needGC);
@@ -2811,7 +2813,7 @@ nsCycleCollector::Collect(bool aMergeCompartments,
     uint32_t totalCollections = 0;
     while (aTryCollections > totalCollections) {
         // Synchronous cycle collection. Always force a JS GC beforehand.
-        GCIfNeeded(true);
+        FixGrayBits(true);
         if (aListener && NS_FAILED(aListener->Begin()))
             aListener = nullptr;
         if (!(BeginCollection(aMergeCompartments, aListener) &&
@@ -3272,7 +3274,7 @@ public:
         if (aListener) {
             aListener->GetWantAllTraces(&wantAllTraces);
         }
-        mCollector->GCIfNeeded(wantAllTraces);
+        mCollector->FixGrayBits(wantAllTraces);
 
         MutexAutoLock autoLock(mLock);
 
diff --git a/xpcom/base/nsCycleCollector.h b/xpcom/base/nsCycleCollector.h
index fbc6b51b2690..098f89f786be 100644
--- a/xpcom/base/nsCycleCollector.h
+++ b/xpcom/base/nsCycleCollector.h
@@ -67,6 +67,11 @@ struct nsCycleCollectionJSRuntime
     virtual void NotifyLeaveCycleCollectionThread() = 0;
     virtual void NotifyEnterMainThread() = 0;
 
+    /**
+     * Unmark gray any weak map values, as needed.
+     */
+    virtual void FixWeakMappingGrayBits() = 0;
+
     /**
      * Should we force a JavaScript GC before a CC?
      */
diff --git a/xpcom/glue/nsProxyRelease.cpp b/xpcom/glue/nsProxyRelease.cpp
index 64b81e0899e8..4b8823e388f2 100644
--- a/xpcom/glue/nsProxyRelease.cpp
+++ b/xpcom/glue/nsProxyRelease.cpp
@@ -30,6 +30,11 @@ NS_ProxyRelease(nsIEventTarget *target, nsISupports *doomed,
 {
     nsresult rv;
 
+    if (!doomed) {
+        // nothing to do
+        return NS_OK;
+    }
+
     if (!target) {
         NS_RELEASE(doomed);
         return NS_OK;
diff --git a/xpcom/glue/nsProxyRelease.h b/xpcom/glue/nsProxyRelease.h
index 51a330c04e8f..78d6868d49aa 100644
--- a/xpcom/glue/nsProxyRelease.h
+++ b/xpcom/glue/nsProxyRelease.h
@@ -117,7 +117,7 @@ public:
   ~nsMainThreadPtrHolder() {
     if (NS_IsMainThread()) {
       NS_IF_RELEASE(mRawPtr);
-    } else {
+    } else if (mRawPtr) {
       nsCOMPtr<nsIThread> mainThread = do_GetMainThread();
       if (!mainThread) {
         NS_WARNING("Couldn't get main thread! Leaking pointer.");
@@ -165,6 +165,7 @@ class nsMainThreadPtrHandle
   nsMainThreadPtrHandle(const nsMainThreadPtrHandle& aOther) : mPtr(aOther.mPtr) {}
   nsMainThreadPtrHandle& operator=(const nsMainThreadPtrHandle& aOther) {
     mPtr = aOther.mPtr;
+    return *this;
   }
 
   operator nsMainThreadPtrHolder<T>*() { return mPtr.get(); }
diff --git a/xpcom/glue/nsThreadUtils.cpp b/xpcom/glue/nsThreadUtils.cpp
index de50728d5047..437e45fec4c1 100644
--- a/xpcom/glue/nsThreadUtils.cpp
+++ b/xpcom/glue/nsThreadUtils.cpp
@@ -37,7 +37,8 @@ nsRunnable::Run()
   return NS_OK;
 }
 
-NS_IMPL_THREADSAFE_ISUPPORTS1(nsCancelableRunnable, nsICancelableRunnable)
+NS_IMPL_THREADSAFE_ISUPPORTS2(nsCancelableRunnable, nsICancelableRunnable,
+                              nsIRunnable)
 
 NS_IMETHODIMP
 nsCancelableRunnable::Run()
diff --git a/xpcom/idl-parser/xpidl.py b/xpcom/idl-parser/xpidl.py
index 5e902d568b5b..551b778feb84 100644
--- a/xpcom/idl-parser/xpidl.py
+++ b/xpcom/idl-parser/xpidl.py
@@ -1009,7 +1009,8 @@ class IDLParser(object):
         'raises': 'RAISES',
         'readonly': 'READONLY',
         'native': 'NATIVE',
-        'typedef': 'TYPEDEF'
+        'typedef': 'TYPEDEF',
+        'Infinity': 'INFINITY'
         }
 
     tokens = [
@@ -1439,9 +1440,11 @@ class IDLParser(object):
 
     def p_optdefvalue(self, p):
         """optdefvalue : '=' STRING
+                       | '=' INFINITY
+                       | '=' '-' INFINITY
                        | """
         if len(p) > 1:
-            p[0] = p[2]
+            p[0] = "".join(p[2:])
         else:
             p[0] = None
 
diff --git a/xpcom/tests/Makefile.in b/xpcom/tests/Makefile.in
index 52f19e7e7e19..58a035fac58e 100644
--- a/xpcom/tests/Makefile.in
+++ b/xpcom/tests/Makefile.in
@@ -73,6 +73,7 @@ CPP_UNIT_TESTS = \
                  TestObserverService.cpp \
                  TestPipe.cpp \
                  TestRefPtr.cpp \
+                 TestSettingsAPI.cpp \
                  TestTextFormatter.cpp \
                  TestTArray.cpp \
                  $(NULL)
diff --git a/xpfe/appshell/public/nsIAppShellService.idl b/xpfe/appshell/public/nsIAppShellService.idl
index 4c7d98affc49..f73bfd42b158 100644
--- a/xpfe/appshell/public/nsIAppShellService.idl
+++ b/xpfe/appshell/public/nsIAppShellService.idl
@@ -16,7 +16,7 @@ interface nsIAppShell;
 struct JSContext;
 %}
 
-[scriptable, uuid(76e6364a-5453-47c7-ad83-8c30eff20a75)]
+[scriptable, uuid(5c19ab54-67bf-46d0-ac5b-21abd9050c3b)]
 interface nsIAppShellService : nsISupports
 {
   /**
@@ -117,4 +117,10 @@ interface nsIAppShellService : nsISupports
    * @param aWindow you see the pattern
    */
   void unregisterTopLevelWindow(in nsIXULWindow aWindow);
+
+  /**
+   * Whether the hidden private window has been lazily created.
+   */
+  [noscript]
+  readonly attribute boolean hasHiddenPrivateWindow;
 };
diff --git a/xpfe/appshell/src/nsAppShellService.cpp b/xpfe/appshell/src/nsAppShellService.cpp
index c66b192a8105..eb9ce06ab2ad 100644
--- a/xpfe/appshell/src/nsAppShellService.cpp
+++ b/xpfe/appshell/src/nsAppShellService.cpp
@@ -82,6 +82,22 @@ NS_IMPL_ISUPPORTS2(nsAppShellService,
 
 NS_IMETHODIMP
 nsAppShellService::CreateHiddenWindow()
+{
+  return CreateHiddenWindowHelper(false);
+}
+
+void
+nsAppShellService::EnsurePrivateHiddenWindow()
+{
+#ifdef MOZ_PER_WINDOW_PRIVATE_BROWSING
+  if (!mHiddenPrivateWindow) {
+    CreateHiddenWindowHelper(true);
+  }
+#endif
+}
+
+nsresult
+nsAppShellService::CreateHiddenWindowHelper(bool aIsPrivate)
 {
   nsresult rv;
   int32_t initialHeight = 100, initialWidth = 100;
@@ -91,7 +107,11 @@ nsAppShellService::CreateHiddenWindow()
   nsAdoptingCString prefVal =
       Preferences::GetCString("browser.hiddenWindowChromeURL");
   const char* hiddenWindowURL = prefVal.get() ? prefVal.get() : DEFAULT_HIDDENWINDOW_URL;
-  mApplicationProvidedHiddenWindow = prefVal.get() ? true : false;
+  if (aIsPrivate) {
+    hiddenWindowURL = DEFAULT_HIDDENWINDOW_URL;
+  } else {
+    mApplicationProvidedHiddenWindow = prefVal.get() ? true : false;
+  }
 #else
   static const char hiddenWindowURL[] = DEFAULT_HIDDENWINDOW_URL;
   uint32_t    chromeMask =  nsIWebBrowserChrome::CHROME_ALL;
@@ -102,23 +122,26 @@ nsAppShellService::CreateHiddenWindow()
   NS_ENSURE_SUCCESS(rv, rv);
 
   nsRefPtr<nsWebShellWindow> newWindow;
-  rv = JustCreateTopWindow(nullptr, url,
-                           chromeMask, initialWidth, initialHeight,
-                           true, getter_AddRefs(newWindow));
-  NS_ENSURE_SUCCESS(rv, rv);
-
-  mHiddenWindow.swap(newWindow);
+  if (!aIsPrivate) {
+    rv = JustCreateTopWindow(nullptr, url,
+                             chromeMask, initialWidth, initialHeight,
+                             true, getter_AddRefs(newWindow));
+    NS_ENSURE_SUCCESS(rv, rv);
 
+    mHiddenWindow.swap(newWindow);
+  }
 #ifdef MOZ_PER_WINDOW_PRIVATE_BROWSING
-  // Create the hidden private window
-  chromeMask |= nsIWebBrowserChrome::CHROME_PRIVATE_WINDOW;
+  else {
+    // Create the hidden private window
+    chromeMask |= nsIWebBrowserChrome::CHROME_PRIVATE_WINDOW;
 
-  rv = JustCreateTopWindow(nullptr, url,
-                           chromeMask, initialWidth, initialHeight,
-                           true, getter_AddRefs(newWindow));
-  NS_ENSURE_SUCCESS(rv, rv);
+    rv = JustCreateTopWindow(nullptr, url,
+                             chromeMask, initialWidth, initialHeight,
+                             true, getter_AddRefs(newWindow));
+    NS_ENSURE_SUCCESS(rv, rv);
 
-  mHiddenPrivateWindow.swap(newWindow);
+    mHiddenPrivateWindow.swap(newWindow);
+  }
 #endif
 
   // RegisterTopLevelWindow(newWindow); -- Mac only
@@ -446,6 +469,8 @@ nsAppShellService::GetHiddenPrivateWindow(nsIXULWindow **aWindow)
 #ifdef MOZ_PER_WINDOW_PRIVATE_BROWSING
   NS_ENSURE_ARG_POINTER(aWindow);
 
+  EnsurePrivateHiddenWindow();
+
   *aWindow = mHiddenPrivateWindow;
   NS_IF_ADDREF(*aWindow);
   return *aWindow ? NS_OK : NS_ERROR_FAILURE;
@@ -458,6 +483,8 @@ NS_IMETHODIMP
 nsAppShellService::GetHiddenPrivateDOMWindow(nsIDOMWindow **aWindow)
 {
 #ifdef MOZ_PER_WINDOW_PRIVATE_BROWSING
+  EnsurePrivateHiddenWindow();
+
   nsresult rv;
   nsCOMPtr<nsIDocShell> docShell;
   NS_ENSURE_TRUE(mHiddenPrivateWindow, NS_ERROR_FAILURE);
@@ -476,6 +503,19 @@ nsAppShellService::GetHiddenPrivateDOMWindow(nsIDOMWindow **aWindow)
 #endif
 }
 
+NS_IMETHODIMP
+nsAppShellService::GetHasHiddenPrivateWindow(bool* aHasPrivateWindow)
+{
+#ifdef MOZ_PER_WINDOW_PRIVATE_BROWSING
+  NS_ENSURE_ARG_POINTER(aHasPrivateWindow);
+
+  *aHasPrivateWindow = !!mHiddenPrivateWindow;
+  return NS_OK;
+#else
+  return NS_ERROR_NOT_IMPLEMENTED;
+#endif
+}
+
 NS_IMETHODIMP
 nsAppShellService::GetHiddenWindowAndJSContext(nsIDOMWindow **aWindow,
                                                JSContext    **aJSContext)
diff --git a/xpfe/appshell/src/nsAppShellService.h b/xpfe/appshell/src/nsAppShellService.h
index 0e6c2d6d8b83..e040678948ad 100644
--- a/xpfe/appshell/src/nsAppShellService.h
+++ b/xpfe/appshell/src/nsAppShellService.h
@@ -32,6 +32,9 @@ public:
 protected:
   ~nsAppShellService();
 
+  nsresult CreateHiddenWindowHelper(bool aIsPrivate);
+  void EnsurePrivateHiddenWindow();
+
   nsresult JustCreateTopWindow(nsIXULWindow *aParent,
                                nsIURI *aUrl, 
                                uint32_t aChromeMask,